HISTORY   [plain text]

In addition to the names listed below, the following people provided
useful inputs on many occasions: Paul D. Robertson, Simon J. Mudd.
Apologies for any names omitted.


	The compiled-in default value for resolve_smtp_sender was
	wrong (from the days that it was a boolean), causing smtpd
	to dump core when the variable was not set in main.cf.

	The INSTALL instructions now have separate sections for
	the three basic ways of running vmailer.

	The INSTALL instructions now have discusses how to deal
	with chrooted processes.

	Ported to RedHat 5.0. My, these people have re-organized
	their include files quite a bit, haven't they.


	On RedHat Linux 4.2/5.0, when a FIFO listener opens the
	FIFO with mode O_RDONLY, the FIFO remains forever readable
	after the writer has closed it.  Workaround: open the FIFO
	mode O_RDWR.

	Test program: util/fifo_rdonly_bug.c

	Unfortunately, the above fix triggers a bug on BSD/OS 3.1
	where opening the FIFO mode O_RDWR causes select() to claim
	that the FIFO is readable even before any data is written
	to it, causing read() to block or to fail.

	Test program:  util/fifo_rdwr_bug.c

	printfck (check arguments of printf-like function calls)
	found a missing argument in local/command.c

	Miscellaneous Makefile cleanups that I didn't finish before
	the first alpha release.


	Sometimes the DNS will claim that a domain does not exist,
	when in fact it does. Thus, it is a bad idea to reject mail
	from apparently non-existent domains. I have changed the
	smtpd so that it produces a soft error responses when a
	resolve_smtp_sender test fails with HOST_NOT_FOUND.  Note:
	by default, this test is still disabled.

	The DB and DBM read routines will now automagically figure
	out if (key, value) pairs were written including a terminating
	null byte or not. The DB and DBM write routines will use
	this result to determine how to write, and will fall back
	to per-system defaults otherwise.

	Renamed the README to MUSINGS, and wrote up a README that
	reflects the current status of the software.

	Added -d (don't disconnect) and -c (show running counter)
	option to te smtp-source test program. These tools are
	great torture tests for the mail software, and for the
	system that it runs on.

	Turned down the process_limit parameter (# of parallel smtp
	clients or servers) to avoid unpleasant surprises. You can
	crank up the process_limit parameter in main.cf.


	Feature: when run by the superuser, mailq now shows the
	mail queue even when the mail system is down. To this end,
	mailq (sendmail -bp) runs the showq program directly instead
	of connecting to the UNIX-domain service socket, and drops
	privileges etc.  as usual.


	Bugfix: Edwin Kremer spotted an oversight in the negated
	host matching code (for name or address patterns prefixed
	by !).

	Bugfix: upon receipt of a SIGHUP signal, the master now
	disconnects from its child processes, so that the current
	generation of child processes commits suicide, and so that
	the next generation of child processes will use the new
	configuration settings.

	Bugfix: the smtp server now skips the sender DNS domain
	lookup test for foo@[address]

	Bugfix: don't append the local domain to foo@[address]


	Bugfix: old low-priority bug in some list walk code that
	caused the master to drop core when a service was turned
	off in master.cf.

	Robustness: the mail system should be able to start up and
	to accept local postings even while the naming service is
	down.  For this reason, the mail system no longer uses
	gethostbyname() to look up its own machine name.  Sites
	that use short hostnames will have to specify their FQDN
	in main.cf (this will eventually be done by the system
	installation/configuration procedure). Should the config
	language support backticks so one can say `domainname`?
	What about $name stuff between the backtics?

	Security: the master now creates FIFOs and UNIX-domain
	sockets as the mail owner instead of as root, for better
	protection against subverted mail systems. chmod() is
	susceptible to race conditions. fchmod(), although safer,
	often does not work on sockets.

	Portability: anticipate that all major UNIXes will create
	UNIX-domain sockets with permissions modified by the process
	umask (required by POSIX). For this reason, we always
	chmod() UNIX-domain sockets, unless the system allows us
	to use the safer fchmod() instead.

	Portability: the semi-resident servers now properly handle
	EWOULDBLOCK returns from accept()  in addition to EGAIN
	(on some systems, EAGAIN and EWOULDBLOCK have different

	Bugfix: the semi-resident servers now properly handle EINTR
	returns From accept().

	Bugfix: Edwin Kremer found that mynetworks() would compute
	(32 - mask) instead of mask.


	Feature: /etc/vmailer/relocated is used by the local delivery
	program and specifies what mail should be bounced with a
	"user has moved to XXX" message. The main.cf configuration
	parameter is "relocated_maps".  Just like the "virtual_maps"
	config parameter, this feature is off by default, and the
	parameter can have values such as "files" or "files, nis"
	(on hosts equipped with NIS).


	Cleanup: virtual domain support moved from the queue manager
	to the resolve service, where it belongs.

	Feature: /etc/vmailer/canonical is used by the rewrite
	service for all addresses, and maps a canonical address
	(user@domain) to another address.  Typical use is to generate
	Firstname.Lastname@domain addresses, or to clean up dirty
	addresses from non-RFC 822 mail systems. The main.cf
	configuration parameter is "canonical_maps".  Just like
	the "virtual_maps" config parameter, this feature is off
	by default, and the parameter can have values such as
	"files" or "files, nis" (on hosts equipped with NIS).


	HPUX10 port and many little fixes from Pieter Schoenmakers.

	Bugfix: isolated an old mysterious bug that could make the
	master deaf for new connections while no child process was
	running.  A typical result was that no pickup daemon would
	be started after the previous one had terminated voluntarily.

	Bugfix: the NIS lookup code did not mystrdup() the NIS map
	name and would access free()d memory.


	Bugfix: the vstream routines would sometimes ignore flushing
	errors. The error would still be reported by vstream_fclose()
	and vstream_ferror().

	Feature: time limit on delivery to shell commands.  Config
	parameter: command_time_limit. Default value: 100 sec. The
	idea is to prevent one bad .forward file or alias file
	entry from slowly using up all local delivery process slots.


	Code cleanup: in preparation for SMTP extensions such as
	SIZE, allow an extended SMTP command to have a variable
	number of options.


	Bugfix: moved canonical map lookups away from the rewriting
	module to the cleanup service, so that canonical map lookups
	do not interfere with address rewriting on behalf of other
	programs. Back to an older trivial-rewrite program version.

	Bugfix: moved virtual map lookups away from the resolver
	back to the queue manager, so that virtual domain lookup
	does not interfere with address resolution on behalf of
	other programs. Back to an older qmgr program version.


	Feature: integrated and adapted Guido van Rooij's SIZE
	option (RFC 1870), carefully avoiding potential problems
	due to overflow (by multiplying large numbers) or unsigned
	underflow (by subtracting numbers).

	Code cleanup: cleaned up the code that parses the server
	response to the HELO/EHLO command, so that we can more
	reliably recognize what options a server supports.


	Portability: integrated the IRIX 6 port by Oved Ben-Aroya.

	Portability: the software now figures out by itself if a
	server should open its FIFO read-write or read-only, to
	avoid getting stuck with a FIFO that stays readable forever.

	Bugfix: the cleanup service would terminate with a fatal
	vstream_fseek() error when the queue file was too large.

	Bugfix: the cleanup service could be killed by a signal
	when the queue file became too large.


	Portability: some systems have statfs(), some have statvfs(),
	and the relevant include files are in a different place on
	almost every system.

	Portability: the makedefs script now nukes the -O compiler
	flag when building on AIX with IBM's own compiler...


	Portability: HP-UX 9.x support by Pieter Schoenmakers.

	Portability: added SYSV-style ulimit() file size limit
	support for HP-UX 9.x.

	Portability: added some #includes that appeared to be
	missing according to the Digital UNIX cc compiler.

	Bugfix: sys_defs.h now correctly specifies NIS support for
	LINUX2, HPUX9 and HPUX10.

	Security: fixed a file descriptor leak in the local delivery
	agent that could give shell commands access to the VMailer
	IPC streams. This should not cause a vulnerability, given
	the design and implementation of the mailer, but it would
	be like asking for trouble.

	Bugfix: the sendmail -B (body type) option did not take a


	Bugfix (SUNOS5): should not have deleted the SVID_GETTOD
	definition from util/sys_defs.h.

	Bugfix (HPUX9): forgot to specify whether to use statfs()
	or statvfs().

	Bugfix (HPUX9): don't try to raise the file size ulimit.

	Bugfix (HPUX9): must specify file size limit in 512-blocks.


	Robustness: the master process now raises the file size
	limit when it is started with a limit that is less than
	VMailer's file size limit.  File: util/file_limit.c.

	Security: the dns lookup routines now screen all result
	names with valid_hostname(). Bad names are treated as
	transient errors.

	Feature: qmail compatibility: when the home_mailbox parameter
	is set, mail is delivered to ~/$home_mailbox instead of to
	/var[/spool]/mail/username.  This hopefully makes it easier
	to lure people away from qmail :-)

	Robustness: several testers by accident configured relayhost
	the same as myhostname. The programs now explicitly check
	for this mistake.

	Bugfix: deliver_request_read() would free unallocated memory
	when it received an incomplete delivery request from the
	queue manager.

	Robustness: local_destination_concurrency=1 prevents parallel
	delivery to the same user (with possibly disastrous effects
	when that user has an expensive pipeline in the .forward
	or procmail config file).  Each transport can have its own
	XXX_destination_concurrency parameter, to limit the number
	of simultaneous deliveries to the same destination.


	Robustness: added "slow open" mode, to gradually increase
	the number of simultaneous connections to the same site as
	long as delivery succeeds, and to gradually decrease the
	number of connections while delivery fails. Brad Knowles
	provided the inspiration to do this.

	This also solves the "thundering herd" problem (making a
	bunch of connections to a dead host when it was time to
	retry that host). Let's see when other mailers fix this.

	Feature: Added $smtpd_banner and $mail_version, for those
	who want to show the world what software version they are

	Bugfix: vmailer-script now properly labels each syslog


	Portability: merged in NEXTSTEP 3 port from Pieter Schoenmakers

	Bugfix: the local delivery program now checks that a
	destination is a regular file before locking it.


	Robustness: the local delivery agent sets HOME, LOGNAME,
	and SHELL when delivering to a user shell command. PATH is
	always set, and TZ is passed through if it is set.


	Feature: mailq (sendmail -bp) now also lists the maildrop
	queue (with mail that hasn't been picked up yet).


	Feature: the smtpd now says: 502 HELP not implemented. This
	should impress the heck out of the competition :-)


	Feature: local delivery to configurable system-wide command
	(e.g.  procmail) avoids the need for per-user ~/.forward
	shell commands. Config parameter: mailbox_command.


	Performance: avoid running a shell when a command contains
	no shell magic characters or built-in shell commands. This
	speeds up delivery to all commands. File: util/exec_command.c.

	Bugfix: the local delivery agent, after reading EOF from
	a child process, now sends SIGKILL only when the child does
	not terminate within a limited amount of time. This avoids
	some problems with procmail.  File:  util/timed_wait.c.


	Portability: folded in NetInfo support from Pieter


	Feature: new vmlock command to run a command while keeping
	an exclusive lock on a mailbox.

	Feature: with "recipient_delimiter = +", mail for local
	address "user+foo" is delivered to "foo", with a "Delivered-To:
	user+foo@domain" message header. Files: qmgr/qmgr_message.c,
	local/recipient.c. This must be the cheapest feature.


	Code cleanup: moved error handling into functions that
	should always succeed (non_blocking(), close_on_exec()).


	Bugfix: null pointer bug in the cleanup program after
	processing a From: header with no mail address (or with
	only a comment).


	Robustness: now detects when getpwnam() returns a name that
	differs from the requested name.

	Feature: Added %p support to the vbuf_print formatting

	Code cleanup: revamped the alias/include/.forward loop
	detection and duplicate suppression code in the local
	delivery agent. This must be the fourth iteration, and
	again the code has been simplified.


	Robustness: don't treat anything starting with whitespace
	as a header record. Instead, explicitly test for leading
	whitespace where we permit it. Files: global/is_header.c,
	bounce/bounce_flush_service.c, local/delivered.c.


	Compatibility: the sendmail program now accepts the -N
	command-line option (delivery status notification) but
	ignores it entirely, just like many other sendmail options.

	Bugfix: dns_lookup.c was too conservative with buffer sizes
	and would incorrectly report "malformed name server reply".


	Bugfix: the local delivery agent was not null-byte clean.


	Feature: integrated Pieter Schoenmaker's code for transport
	lookup tables that list (transport, nexthop) by destination.


	Bugfix: delivery agents no longer rename corrupt queue
	files, because programs might fall over each other doing
	so. Instead, when a delivery agent detects queue file
	corruption, it chmods the queue file, simulates a soft
	error, and lets the queue manager take care of the problem.

	Bugfix: the SMTP server implemented VRFY incorrectly.

	Feature: first shot at a pipe mailer, which can be used to
	extend VMailer with external mail transports such as UUCP
	(provided that the remote site understands domain addressing,
	because VMailer version 1 does not rewrite addresses).

	Cleanup: extended the master/child interface so that the
	service name (from master.cf) is passed on to the child.
	The pipe mailer needs the service name so it can look up
	service-specific configuration parameters (privilege level,
	recipient limit, time limit, and so on).


	Cleanup: factored out the pipe_command() code, so it can
	be shared between pipe mailer and local delivery agent.


	Compatibility: the sendmail program now parses each
	command-line recipient as if it were an RFC 822 message
	header; some MUAs specify comma-separated recipients in a
	command-line argument; and some MUAs even specify "word
	word <address>" forms as command-line arguments.


	Bugfix: VMailer's queue processing randomization wasn't
	adequate for unloaded systems with small backlogs.

	Bugfix: smtpd now uses double-buffered stream I/O to prevent
	loss of input sent ahead of responses.


	Bugfix: the smtpd anti-relay code didn't treat all hosts
	listed in $mydestinations as local, so it would accept mail
	only for hosts listed in $relay_domains (default: my own

	Bugfix: smtpd now replies with 502 when given an unknown


	Cleanup: resolve/rewrite clients now automatically disconnect
	after a configurable amount of idle time (ipc_idle).


	Tolerance: VRFY now permits user@domain, even though the
	RFC requires that special characters such as @ be escaped.


	Bugfix: a recipient delimiter of "-" could interfere with
	special addresses such as owner-xxx or double-bounce.

	Tolerance: the SMTP client now permits blank lines in SMTP
	server responses.

	Tolerance: the SMTP client now falls back to SMTP when it
	apparently mistook an SMTP server as ESMTP capable.

	Bugfix: eliminated strtok() calls in favor of mystrtok().
	Symptom: master.cf parsing would break if $inet_interfaces
	was more than one word.


	Bugfix: user->addr patterns in canonical and virtual tables
	matched only $myorigin, not hosts listed in $mydestination
	or addresses listed in $inet_interfaces.  The man pages
	were wrong too. File: global/addr_match.c.


	Robustness: FIFO file permissions now default to 0622.  On
	some systems, opening a FIFO read-only could deafen the
	pickup daemon.  Only the listener end (which is opened as
	root) needs read access anyway, so there should not be a
	loss of functionality by making FIFOs non-readable for
	non-mail processes.


	Compatibility: sendmail -I and -c options added.


	Feature: virtual lookups are now recursive. File:


	Implemented sendmail -bs (stand-alone) mode. This mode runs
	as the user and therefore deposits into the maildrop queue.


	The pickup service now removes malformed maildrop files.


	The pickup service now guards against maildrop files with
	time stamps dated into the future.


	Bugfix: in the canonical and virtual maps, foo->address
	would match foo@$myorigin only. This has been fixed to also
	match hosts listed in main.cf:$mydestination and the
	addresses listed in main.cf:$inet_interfaces.

	Bugfix: added double buffering support to the VMailer SMTP
	server. This makes the SMTP server robust against SMTP
	clients that talk ahead of time, and should have been in
	there from day one.


	Bugfix: the VMailer SMTP client now recognizes its own
	hostname in the SMTP greeting banner only when that name
	appears as the first word on the first line.


	Feature: smtpd now logs the local queue ID along with the
	client name/address, and pickup now logs the local queue
	ID along with the message owner.

	Bugfix: still didn't do virtual/canonical lookups right
	(code used the non-case-folded key instead of the case
	folded one).


	Bugfix: the SMTP server did not flush the "250 OK queued
	as XXXX" message from the SMTP conversation history.


	Bugfix: qmgr would not notice that a malformed message has
	multiple senders, and would leak memory (Tom Ptacek).


	Portability: in the mantools scripts, the expr pattern no
	longer has ^ at the beginning, and the scripts now use the
	expand program instead of my own detab utility.


	NetBSD 1.x patch by Soren S. Jorvang.


	Feature: the SMTP server now logs the protocol (SMTP or
	ESMTP) as part of the Received: header.

	Feature: smtpd now logs the last command when a session is
	aborted due to timeout, unexpected EOF, or too many client


	Bugfix: the queue manager did not update the counter for
	in-core message structures, so the in-core message limit
	had no effect. This can be bad when you have a large backlog
	with many messages eligible for delivery.

	Robustness: the queue manager now also limits the total
	number of in-core recipient structures, so that it won't
	use excessive amounts of memory on sites that have large
	mailing lists.


	Bugfix: the SMTP client did not notice that the DNS client
	received a truncated response. As a result, a backup MX
	host could incorrectly claim that it was the best MX host
	and declare a mailer loop.

	Added start_msg/stop_msg entries to the vmailer startup
	script, for easy installation.

	Cleanup: VMailer databases are now explicitly specified as
	type:name, for example, hash:/etc/aliases or nis:mail.aliases,
	instead of implicitly as "files", "nis" and so on. Test
	program:  util/dict_open.  This change allowed me to
	eliminate a lot of redundant code from mkmap_xxx.c, and
	from everything that does map lookups.


	Bugfix: local/dotforward.c compared the result of opening
	a user's ~/.forward against the wrong error value.


	Bugfix: the smtpd VRFY command could look at free()d memory.

	Robustness: the smtpd program had a fixed limit on the
	number of token structures.  The code now dynamically
	allocates token structures.

	Bugfix: the queue manager still used the deprecated parameter
	name xxx_deliver_concurrency for concurrency control, but
	the documentation talks about the preferred parameter name
	xxx_destination_concurrency.  Fix: try xxx_destination_concurrency
	first, then fall back to xxx_deliver_concurrency.


	Cleanup: the string read routines now report the last
	character read or VSTREAM_EOF. This change is necessary
	for the implementation of the long SMTP line bugfix.

	Bugfix: the smtp server exited the DATA command prematurely
	when the client sent long lines. Reason: the smtp server
	did not remember that it broke long lines, so that '.'
	could appear to be the first character on a line when in
	fact it wasn't.

	Bugfix: the queue manager made lots of stupid errors while
	reading $qmgr_message_recipient_limit chunks of recipients
	from a queue file. This code has been restructured.


	Performance: the cleanup program now always adds return-receipt
	and errors-to records to a queue file, so that the queue
	manager does not have to plow through huge lists of

	Robustness: the initial destination concurrency now defaults
	to 2, so that one bad message or one bad connection does
	not stop all mail to a site. The configuration parameter
	is called initial_destination_concurrency.

	Performance: the per-message recipient limit is now enforced
	by the queue manager instead of by the transport. Thus, a
	large list of recipients for the same site is now mapped
	onto several delivery requests which can be handled in
	parallel, instead of being mapped onto one delivery request
	that is sent to limited numbers of recipients, one group
	after the other.


	Cleanup: the queue manager now does an additional recipient
	sort after the recipients have been resolved, so that the
	code can do better aggregation of recipients by next hop

	Feature: lines in the master.cf file can now be continued
	in the same manner as lines in the main.cf file, i.e. by
	starting the next line with whitespace.

	Feature: the smtp client now warns that a message may be
	delivered multiple times when the response to "." is not
	received (the problem described in RFC 1047).

	Cleanup: when the queue manager changes its little mind
	after contacting a delivery agent (for example, it decides
	to skip the host because a transport or host goes bad),
	the delivery agent no longer complains about premature EOF.
	File: global/deliver_request.c


	Bugfix: when breaking long lines, the SMTP client did not
	escape leading dots in secondary etc. line fragments.  Fix:
	don't break lines. This change makes VMailer line-length
	transparent.  Files: global/smtp_stream.c, smtp/smtp_proto.c.


	Cleanup: the queue manager to deliver agent protocol now
	distinguishes between domain-specific soft errors and
	recipient-specific soft errors.  Result: many soft errors
	with SMTP delivery no longer affect other mail the same


	Feature: the file modification time stamp of deferred queue
	files is set to the nearest wakeup time of their recipient
	hosts, or if delivery was deferred due to a non-host problem,
	the time stamp is set into the future by the configurable
	minimal backoff time.

	Bugfix: the SMTP client and the MAILQ command would report
	as message size the total queue file size. That would
	grossly overestimate the size of a message with many

	Bugfix: the 19980709 fix screwed up locally-posted mail
	that didn't end in newline.


	Robustness: the makedefs script now defaults to no optimization
	when compiling for purify.


	Robustness: the makedefs script now defaults to no optimization
	when compiling with gcc 2.8, until this compiler is known
	to be OK.

	Workaround: when sending multiple messages over the same
	SMTP connection, some SMTP servers need an RSET command
	before the second etc. MAIL FROM command. The VMailer SMTP
	client now sends a redundant RSET command just in case.

	The queue manager now logs explicitly when delivery is
	deferred because of a "dead" message transport.


	Feature: mailq and mail bounces now finally report why mail
	was deferred (the reason was logged to the syslog file
	only).  Changes were made to the bounce service (generalized
	to be usable for defer logs), showq service (to show reasons)
	and the queue manager.

	As a result the defer directory (with one log per deferred
	message) may contain many files; also, this directory is
	accessed each time a message is let into the active queue,
	in order to delete its old defer log. This means that hashed
	directories are now a must.


	Feature: configurable timeout for establishing smtp
	connections.  Parameter:  smtp_connect_timeout (default 0,
	which means use the timeout as wired into the kernel).
	Inspired by code from Lamont Jones. For a clean but far
	from trivial implementation, see util/timed_connect.c

	Cleaned up the interfaces that implement read/write deadlines.
	Instead of returning -2, the routines now set errno to
	ETIMEDOUT; the readable/writable tests are now separate.


	Feature: the default indexed file type (hash, btree, dbm)
	is now configurable with the "database_type" parameter.
	The default value for this parameter is system specific.

	Feature: selectively turn on verbose logging for hosts that
	match the patterns specified via the "debug_peer_list"
	config parameter.  Syntax is like the "bad_smtp_clients"
	parameter (see global/peer_list.c). The verbose logging
	level is specified with "debug_peer_level" (default 2).

	Security: the local delivery agent no longer delivers to
	files that have execute permission enabled.


	Workarounds for Solaris 2.x UNIX-domain sockets: they lose
	data when you close them immediately after writing to them.
	This could screw up the delivery agent to queue manager


	Cleanup: spent most of the day cleaning up queue manager
	code that defers mail when a site or transport dies, and
	fixed a few obscure problems in the process.


	Feature: the admin can now configure what classes of problems
	result in mail to the postmaster. Configuration parameter:
	"notify_classes".  Default is backwards compatible: bounce,
	policy, protocol, resource, and software.


	Feature: the admin can now configure what smtp server access
	control restrictions must be applied, and in what order.
	Configuration parameters:  smtpd_client_restrictions,
	smtpd_helo_restrictions, smtpd_mail_restrictions and
	smtpd_rcpt_restrictions. Defaults are intended to be
	backwards compatible. The bad_senders and bad_clients lists
	are gone and have become db (dbm, nis, etc) maps. Files:
	smtpd/smtpd_check.c, config/main.cf.


	Feature: hashed queues. Rewrote parts of the mail queue
	API.  Configuration parameters: "hash_queue_names" specifies
	what queue directories will be hashed (default: the defer
	log directory), "hash_queue_depth" specifies the number of
	subdirectories used for hashing (default 2).


	Bugfix: the pipe mailer should expand command-line arguments
	with $recipient once for every recipient (producing one
	command-line argument per recipient), instead of replacing
	$recipient by of all recipients (i.e.  producing only one
	command-line argument).  This is required for compatibility
	with programs that expect to be run from sendmail, such as
	uux. Thanks to Ollivier Robert for helping me to get this

	Code cleanup: for the above, cleaned up the macro expansion
	code in dict.c and factored out the parsing into a separate
	module, mac_parse.c.


	"|command" and /file/name destinations in alias databases
	are now executed with the privileges of the database owner
	(unless root or vmailer).  Thus, with: "alias_maps =
	hash:/etc/aliases, hash:/home/majordomo/aliases", and with
	/home/majordomo/aliases* owned by the majordomo account,
	you no longer need the majordomo set-uid wrapper program,
	and you no longer need root privileges in order to install
	a new mailing list.


	Added support for the real-time blackhole list.  Example:
	"client_restrictions = permit_mynetworks, reject_maps_rbl"

	All SMTP server "reject" status codes are now configurable:
	unknown_client_reject_code, mynetworks_reject_code,
	invalid_hostname_reject_code, unknown_hostname_reject_code,
	unknown_address_reject_code, relay_domains_reject_code,
	access_map_reject_code, maps_rbl_reject_code. Default values
	are documented in the smtpd/smtpd_check.c man page.


	Code cleanup: after eye balling line-by line diffs, started
	deleting code that duplicated functionality because it was
	at the wrong abstraction level (smtp_trouble.c), moved
	functionality that was in the wrong place (dictionary
	reference counts in maps.c instead of dict.c), simplified
	code that was too complex (password-file structure cache)
	and fixed some code that was just wrong.


	Robustness: the number of queue manager in-core structures
	for dead hosts is limited; the limit scales with the limit
	on the number of in-core recipient structures. The idea is
	to not run out of memory under conditions of stress.


	Feature: mail to files and commands can now be restricted
	by class:  alias, forward file or include file. The default
	restrictions are:  "allow_mail_to_files = alias, forward"
	and allow_mail_to_commands = alias, forward". The idea is
	to protect against buggy mailing list managers that allow
	intruders to subscribe /file/name or "|command".


	Cleanup: deleted a couple hundred lines of code from the
	local delivery agent. It will never be a great program;
	sendmail compatibility is asking a severe toll.


	Cleanup: made the program shut up about some benign error
	conditions that were reported by Daniel Eisenbud.


	Documentation: made a start of HTML docs that describe all
	configuration parameters.

	Feature: while documenting things, added smtpd_helo_required.


	Bugfix: at startup the queue manager now updates the time
	stamps of active queue files some time into the future.
	This eliminates duplicate deliveries after "vmailer reload".

	Bugfix: the local delivery agent now applies the recipient
	delimiter after looking in the alias database, instead of

	Documentation bugfixes by Matt Shibla, Tom Limoncelli,
	Eilon Gishri.


	GLIBC fixes from Myrdraal.

	Bugfix: applied showq buffer reallocation workaround in
	the wrong place.

	Bugfix: can't use shorts in varargs lists. SunOS 4 has
	short uid_t and gid_t. pipe_command() would complain.

	Bugfix: can't use signed char in ctype macros. All ctype
	arguments are now casted to unsigned char. Thanks, Casper


	Bugfix: save the alias lookup result before looking up the
	owner.  The previous alpha release did this right.

	Cleanup: mail_trigger() no longer complains when the trigger
	FIFO or socket is unavailable. This change is necessary to
	shut up the sendmail mail posting program, so that it can
	be used on mail clients that mount their maildrop via NFS.

	Experiment: pickup and pipe now run as vmailer most of the
	time, and switch to user privileges only temporarily.
	Files: util/set_eugid.c global/pipe_command.c pipe/pipe.c
	pickup/pickup.c. Is this more secure/ What about someone
	manipulating such a process while not root? It still has
	ruid == 0.


	Portability: with GNU make, commands such as "(false;true)"
	and "while :; do false; done" don't fail. Workaround: use
	"set -e" all over the place.  Problem found by Jeff Wolfe.

	Feature: "check_XXX_access maptype:mapname" (XXX = client,
	helo, sender, recipient). Now you can make recipient and
	other SPAM restrictions dependent on client or sender access
	tables lookup results.


	Bugfix: smtpd access table lookup keys were case sensitive.

	Added "permit" and "reject" operators. These are useful at
	the end of SPAM restriction lists (smtpd_XXX_restrictions).

	Added a first implementation of the permit_mx_backup SPAM
	restriction. This permits mail relaying to any domain that
	lists this mail system as an MX host (including mail for
	the local machine). Thanks to Ollivier Robert for useful


	Bugfix: transport table lookup keys were case sensitive.


	Portability: sa_len is some ugly #define on some SGI systems,
	so we must rename identifiers (file util/connect.c).

	Bugfix: uucp delivery errors are now sent to the sender.
	Thanks, Mark Delany.

	Bugfix: the pipe delivery agent now replaces empty sender
	by the mailer daemon address. Mark Delany, again.

	Portability: GNU getopt looks at all command-line arguments.
	Fix: insert -- into the pipe/uucp definition in master.cf.

	Bugfix: the smtp server command tokenizer silently discarded
	the [] around [text], so that HELO [x.x.x.x] was read as
	if the client had sent: HELO x.x.x.x. Thanks, Peter Bivesand.

	Bugfix: the HELO unknown hostname/bad hostname restrictions
	would have treated [text] as a domain name anyway.

	Bugfix: the $local_duplicate_filter_limit value was not
	picked up by the local delivery agent. This means the local
	delivery agent could run out of memory on large mailing
	list deliveries.


	Performance: mkmap/mkalias now run with the same speed as
	sendmail. VMailer now uses a 4096-entry cache with 1 Mbyte
	of memory for DB lookups.  File: util/dict_db.c.


	Robustness: the reject_unknown_hostname restriction for
	HELO/EHLO hostnames will now permit names that have an MX
	record instead of an A record.


	Feature: appending @$myorigin to an unqualified address is
	configurable with the boolean append_at_myorigin parameter
	(default: yes).

	Feature: appending .$mydomain to user@host is configurable
	with the boolean append_dot_mydomain parameter (default:

	Feature: site!user is rewritten to user@site, under control
	of the boolean parameter swap_bangpath (default: yes).

	Feature: permit a naked IP address in HELO commands (i.e.
	an address without the enclosing [] as required by the
	RFC), by specifying "permit_naked_ip_address" as one of
	the restrictions in the "smtpd_helo_restrictions" config


	Code cleanup: when an SMTP client aborts a session after
	sending MAIL FROM, the cleanup service no longer warns that
	it is "skipping further client input". Files: cleanup/*.c.
	Thanks, Daniel Eisenbud, for prodding.

	Code cleanup: when an SMTP server disconnects in the middle
	of a session, don't try to send QUIT over the non-existing
	connection. Files: global/smtp_stream.c, smtp/smtp.c.
	Thanks, Daniel Eisenbud, for prodding, again.

	Code cleanup: the VMailer version number has moved from
	mail_params.h (which is included by lots of modules) to a
	separate file global/mail_version.h, so that a version
	change no longer results in massive recompilation.

	Bugfix: Errors-To was flagged as a sender address, so the
	address never was picked up.

	Code cleanup: support for Errors-To: headers completed.


	Feature: per-message exponential delivery backoff, by
	looking at the amount of time a message has been queued.
	Thanks, Mark Delany.


	Code cleanup: ripped out the per-host exponential backoff
	code. It was broken by 19980818. It was probably a bad idea
	anyway, because it required per-host, in-core, state kept
	by the queue manager.  All we do now is to keep state for
	$minimal_backoff_time seconds, but only for a limited number
	of hosts. Daniel Eisenbud spotted the problem.

	Lost feature: the SMTP session transcripts now show who
	said what. This feature was inadvertently dropped during
	development. Thanks, Daniel Eisenbud, for reminding.

	Documentation: the hard-coded rewriting process of the
	trivial-rewrite program is described in html/rewrite.html.

	Feature: the local delivery agent now does alias lookups
	before and after chopping off the recipient subaddress.
	This allows you to forward user-anything to another user,
	without losing the ability to redirect specific user-foo


	Feature: the smtp client now logs a warning that a server
	sends a greeting banner with the client's hostname, which
	could imply a mailer loop.


	Feature: separate canonical maps for sender and recipient
	address rewriting, so that you can rewrite an ugly sender
	address and still forward mail to that same ugly address
	without creating a mailer loop.  Files: cleanup_envelope.c,
	cleanup_message.c, cleanup_rewrite.c.


	Feature: virtual maps now support multiple addresses on
	the right-hand side. In the case of virtual domains this
	can eliminate the need for address expansion via local
	aliases, making virtual domains much easier to administer.
	This required that I moved the virtual table lookups from
	the queue manager to the cleanup service, so that every
	recipient has an on-disk status record.  Files: qmgr.c,
	qmgr_message.c, cleanup_envelope.c, cleanup_rewrite.c,

	Feature: sendmail/mailq/newaliases pass on the -v flag to
	the program that they end up running, to make debugging a
	little easier.


	Bugfix: some anti-spam measures didn't recognize some
	addresses as local and would do too much work. File:

	Bugfix: the smtp sender/recipient table lookup restriction
	destroyed global data, so that other restrictions could
	break. File: smtpd_check.c.

	Bugfix: after vmailer reload, single-threaded servers could
	exit before flushing unwritten data to the client. Example:
	cleanup would exit before acking success to pickup, so the
	message would be delivered twice. Bug reported by Brian

	Cleanup: removed spurious error output from vmailer-script.
	Reported by Brian Candler.

	Tolerance: ignore non-numeric SMTP server responses. There's
	lot of brain damage out there on the net.


	Feature: the smtp-sink benchmark tool now announces itself
	with a neutral name so that it can be run on the same
	machine as VMailer, without causing Postfix to complain
	about a mailer loop.

	Robustness: on LINUX, vmailer-script now does chattr +S to
	force synchronous directory updates. Fix developed with
	Chris Wedgwood.


	Bugfix: when transforming an RFC 822 address to external
	form, there is no need to quote " characters in comments.
	This didn't break anything, it just looked ugly.  File:


	Workaround: with deliveries to /file/name, use fsync() and
	ftruncate() only on regular files.  File: local/file.c

	Workaround: the plumbing code in master_spawn.c didn't
	check if it was dup2()/close()ing a descriptor to itself
	then closing it. Will have to redo the plumbing later.


	Workaround: on multiprocessor Solaris machines, one-second
	rollover appears to happen on different CPUs at slightly
	different times. Made the queue manager more tolerant for
	such things.  Problem reported by Daniel Eisenbud.

	Workaround: in preparation for deployment with a network-shared
	maildrop directory. make pickup more tolerant against clock
	drift between clients and servers.


	New vstream_popen() module that opens a two-way channel
	across a socketpair-based pipe. This module isn't being
	used yet; it is here only to complete the vstream code.


	Code cleanup: the xxx_server_main() interface for master
	child processes now uses a name-value argument list instead
	of an ugly and inflexible data structure.

	Bugfix: moved the test if a non-interactive process is run
	by hand, so that the "don't do this" error message can be
	printed to stderr before any significant processing.

	Bugfix: smtpd now can talk to unix-domain sockets without
	bailing out on a peer lookup problem. Files: smtpd/smtpd.c,

	Safety: by default, the postmaster is no longer informed
	of protocol problems, policy violations or bounces.

	Safety: the SMTP server now sleeps before sending a [45]xx
	error response, in order to prevent clients from hammering
	the server with a connect/error/disconnect loop. Parameter:
	smtpd_error_sleep_time (default: 5).

	Feature: the logging facility is compile-time configurable
	(e.g., make makefiles "CCARGS=-DLOG_FACILITY=LOG_LOCAL1").


	Bugfix: changed virtual/canonical map search order from
	(user@domain, @domain, user) to (user@domain, user, @domain)
	so the search order is most specific to least specific.
	File: global/addr_map.c, lots of documentation.

	Bugfix: after the change of 19980910, cleanup_message
	extracted recipients from Reply-To: etc. headers.  Found
	by Lamont Jones.


	Bugfix: the change in virtual/canonical map search order
	broke @domain entries; they would never be looked up if
	the address matched $myorigin or $mydestinations. Found by
	Chip Christian who now regrets asking for the change.

	Bugfix: cleanup initialized an error mask incorrectly, so
	that it would keep writing to a file larger than the queue
	file size limit, and so it would treat the error as a
	recoverable one instead of sending a bounce. Thanks, Pieter

	Bugfix: the "queue file cleanup on fatal error" action was
	no longer enabled in the sendmail mail posting agent.

	Feature: the sendmail mail posting program now returns
	EX_UNAVAILABLE when the size of the input exceeds the queue


	Code cleanup: the dotlock file locking routine is no longer
	derived from Eric Allman's 4.3BSD port of mail.local.

	Code cleanup: the retry strategy of the file locking routines
	dot_lockfile() and deliver_flock() is now configurable
	(deliver_flock_attempts, deliver_flock_delay, deliver_flock_stale).

	Code cleanup: the master.pid lock file is now created with
	symlink paranoia, and is properly locked so that PID rollover
	will not cause false matches.

	Bugfix: the vbuf_print() formatting engine did not know
	about the '+' format specifier.

	Cleanup: replaced unnecessary instances of stdio calls by
	vstream ones.


	Compatibility: added support for "sendmail -q". This required
	a change to the queue manager trigger protocol, and a code
	reorganization of the way queue scans were done. The queue
	manager socket now has become public.


	SMTPD now logs "lost connection after end-of-message"
	instead of "lost connection after DATA".


	More bullet proofing: timeouts on all triggers.


	Bugfix: make the number of cleanup processes unlimited, in
	order to avoid deadlock. The number of instances needed is
	one per smtp/pickup process, and an indeterminate number
	per local delivery agent. Thanks, Thanks, David Miller and
	Terry Lorrah for cleueing me in.

	Bugfix: "sendmail -t" extracted recipients weren't subjected
	to virtual mapping. Daniel Eisenbud strikes again.


	Compatibility: if the first input line ends in CRLF, the
	sendmail posting agent will treat all CRLF as LF. Otherwise,
	CRLF is left alone. This is a compromise between sendmail
	compatibility (all lines end in CRLF) and binary transparency
	(some, but not all, lines contain CRLF).


	Robustness: stop recursive virtual expansion when the
	left-hand side appears in its own expansion.


	Portability: trigger servers such as pickup and qmgr can
	now use either FIFOs or UNIX-domain sockets; hopefully at
	least one of them works properly. Trigger clients were
	already capable of using either form of local IPC.


	Feature: masquerading. Strip subdomains from domains listed
	in $masquerade_domains. Exception: envelope recipients are
	left alone, in order to not screw up routing.


	Code cleanup: moved the recipient duplicate filter from
	the user-level sendmail posting agent to the semi-resident
	cleanup service, so that the filter operates on the output
	from address canonicalization and of virtual expansion,
	instead of operating on their inputs.


	Bugfix: after kill()ing a bunch of child processes, wait()
	sometimes fails before all children have been reaped, and
	must be called again, or the master will SIGSEGV later.
	Problem reported by Scott Cotton.

	Workaround: don't log a complaint when an SMTP client goes
	away without sending QUIT.


	Workaround: Solaris 2.5 ioctl SIOCGIFCONF returns a hard
	error (EINVAL) when the result buffer is not large enough.
	This can happen on systems with many real or virtual
	interfaces. File: util/inet_addr_local.c. Problem reported
	by Scott Cotton.

	Workaround: the optional HELO/EHLO hostname syntax check
	now allows a single trailing dot.

	Workaround: with UNIX-domain sockets, LINUX connect() blocks
	until the server calls accept(). File: qmgr/qmgr_transport.c.
	Terry Lorrah and Scott Cotton provided the necessary


	Robustness: recursive canonical mapping terminates when
	the result stops changing.

	Code cleanup: reorganized the address rewriting and mapping
	code in the cleanup service, to make it easier to implement
	the previous enhancement.


	Code cleanup: more general queue scanning programming
	interface, in preparation for hashed queues. File:

	Bugfix: a non-FIFO server with a process limit of 1 has a
	too short listen queue.  Until now this was not a problem
	because only FIFO servers had a process limit of 1, and
	FIFOs have no listen queue.  Fix: always configure a listen
	queue of proc_limit or more.  File: master/master_listen.c.


	Feature: by popular request, mail delay is logged when
	delivering, bouncing or deferring mail.


	Cleanup: double-bounce mail is now absorbed by the queue
	manager, instead of the local delivery agent, so that the
	mail system will not go mad when no local delivery agent
	is configured.


	Cleanup: moved the relocated table from the local delivery
	agent to the queue manager, so that the table can also be
	used for virtual addresses.

	Code reorg: in order for the queue manager to absorb
	recipients, the queue file has to stay open until all
	recipients have been assigned to a destination queue.


	vmlogger command, so that vmailer-script logging becomes
	consistent with the rest of the VMailer system.

	Code reorg: logger interface now can handle multiple output
	handlers (e.g. syslog and stderr stream).

	Bugfix: a first line starting with whitespace is no longer
	treated as an extension of our own Received: header. Files:
	smtpd/smtpd.c, pickup/pickup.c.


	Bugfix: the bang-path swapping code went into a loop on an
	address consisting of just a single !. Eilon Gishri had
	the privilege of finding this one.

	Workaround: the non-blocking UNIX-domain socket connect is
	now enabled only on systems that need it. It may cause
	kernel trouble on Solaris 2.x.

	Bugfix: the resolver didn't implement bangpath swapping,
	so that mail for site!user@mydomain would be delivered to
	a local user named "site!user".


	Cleanup: a VSTREAM can now use different file descriptors
	for reading and writing. This was necessary to prevent
	"sendmail -bs" and showq from writing to stdin. Eilon Gishri
	observed the problem.


	The RFC 822 address manipulation routines no longer give
	special attention to 8-bit data. Files: global/tok822_parse.c,

	Bugfix: host:port and other non-domain stuff is no longer
	allowed in mail addresses.  File: qmgr/qmgr_message.c.

	Workaround: LINUX accept() wakes up before the three-way
	handshake is complete, so it can fail with ECONNRESET.
	Files: master/single_server.c, master/multi_server.c.

	Feature: when delivering to user+foo, try ~user/.forward+foo
	before trying ~user/.forward.

	Bugfix: smtpd in "sendmail -bs" (stand-alone) mode didn't
	clean up when terminated by a signal.

	Bugfix: smtpd in "sendmail -bs" (stand-alone) mode should
	not try to enforce spam controls because it cannot access
	the address rewriting machinery.

	Cleanup: the percent hack (user%domain -> user@domain) is
	now configurable (allow_percent_hack, default: yes).

	Bugfix: daemons in -S (stand-alone) mode didn't change
	directory to the queue. This was no problem with daemons
	run by the sendmail compatibility program.


	Feature: when virtual/canonical/relocated lookup fails for
	an address that contains the optional recipient delimiter
	(e.g., user+foo@domain), the search is done again with the
	unextended address (e.g., user@domain). File: global/addr_find.c.

	Code reorg: the address searching is now implemented by a
	separate module global/addr_find.c, so that the same code
	can be used for both (non-mapping) relocated table lookups
	and for canonical and virtual mapping. The actual mapping
	is still done in the global/addr_map.c module.

	Robustness: the SMTP client now skips hosts that don't send
	greeting banner text. File: smtp/smtp_connect.c

	Feature: preliminary support to disable delivered-to. This
	is desirable for mailing list managers that don't want to
	advertise internal aliases.

	Generic support: when the recipient_feature_delimiter
	configuration parameter is set, the local delivery agent
	uses it to split the recipient localpart into fields. Any
	field that has a known name such as "nodelivered" enables
	the corresponding delivery feature.


	Code reorg: address splitting on recipient delimiter is
	now centralized in global/split_addr.c, which knows about
	all reserved names that should never be split.

	Robustness: when a request for an internal service cannot
	be satisfied because the master has terminated, terminate
	instead of trying to reach the service every 30 seconds.

	Safety: the local delivery agent now runs as vmailer most
	of the time, just like pickup and pipe. Files: local/local.c,


	Compatibility: the tokenizer for alias/forward/etc.
	expansion now updates an optional counter with the number
	of destinations found; If no destinations is found in a
	.forward file, deliver to the mailbox instead. Thanks,
	Daniel Eisenbud, for showing the way to go.

	Robustness: the pickup daemon should always include a
	posting-time record, even when the sendmail posting agent
	didn't. However, just like before, user-provided posting
	times will be ignored. Ollivier Robert found this one.

	Robustness: duplicate entries in aliases or maps now cause
	a warning instead of a fatal error (and an incomplete file).

	Robustness: mkmap now prints a warning when an entry is in
	"key: value" format, which is the format expected for alias
	databases, not for maps.

	Portability: on LINUX, prepend "+" to the getopt() options
	string so that getopt() will stop at the first non-option
	argument. Suggestion by Marco d'Itri.


	Cleaned up the set_eugid() and open_as() implementations,
	and added stat_as() and fstat_as() so that the local delivery
	agent would look up include files and .forward files with
	the right privileges.


	Bugfix: the :include: routine now stat()s/open()s files
	included by root-owned aliases as root, not as nobody.

	Bugfix: the master crashed when a service with wakeup timer
	was disabled or renamed.  Fix: eliminate some pathological
	coupling between process management and wakeup management.

	Feature: partial implementation of ETRN (causes a full
	deferred queue scan). Thanks Lamont Jones for reminding me
	that things can be useful already before they are perfect.

	Cleanup: simplified the SMTPD tokenizer.

	Bugfix: sendmail -bs didn't properly notify the mail system
	of new mail.

	Compatibility: the MAIL FROM and RCPT TO commands now accept
	the most common address forms without enclosing <>. The <>
	is still needed for addresses that contain a "string", an
	[address], or a colon (:).


	Bugfix: "master -t" would claim that the master runs when
	in fact the pid directory does not exist, causing trouble
	with first time startup (reported by several).

	Portability: added a sane_accept() module that maps all
	beneficial accept() error results to EAGAIN. According to
	private communication with Alan Cox, Linux 2.0.x accept()
	can return a variety of error conditions, so we play safe
	and allow for any error that may happen because SYN+ACK
	could not be sent.

	Portability: NETBSD1 uses dotlock files (Perry Metzger).

	Bugfix: the local delivery agent did not canonicalize
	owner-foo sender addresses, so that local users would see
	owner-foo instead of owner-foo@$myorigin (Perry Metzger).

	OPENSTEP4 support, similar to NEXTSTEP3 (Gerben Wierda).


	Portability: the master startup would take a long time on
	AIX because AIX has a very large per-process open file
	limit.  Fix is to check the status of only the first couple
	hundred file descriptors instead. File: master/master.c.

	Bugfix: mail to user@[net.work.addr.ess] was broken because
	of a reversed test. File: qmgr/qmgr_message.c.


	Compatibility: don't clobber the envelope sender address
	when an alias has no owner-foo alias (problem diagnosed by
	Christophe Kalt).

	Bugfix: mail to local users in include files would be
	delivered directly if the alias didn't have an owner-foo
	alias, and if the alias database and include file were
	owned by root.

	Feature: with user+foo addresses, any +foo address extension
	that is not explicitly matched in canonical, virtual or
	alias databases is propagated to the table lookup result.


	Bugfix: minor memory leak in the user+foo table lookup

	Configurability: specify virtual.domain in the virtual map,
	and mail for unknown@virtual.domain will bounce automatically.
	The $relay_domains default value now includes $virtual_maps,
	so the SMTP server will accept mail for the domain. Marco
	d'Itri put me on the right track.

	Configurability: The mydestinations configuration parameter
	now accepts /file/name expressions and type:name lookup

	Code cleanup: in order to make the previous two enhancements
	possible, revised the string/host/address matching engine
	so it can handle any mixture of strings, /file/name patterns
	and type:name lookup tables. Files: util/match_{list,ops}.c,


	Code cleanup: replaced remaining isxxx() calls by ISXXX().


	Bugfix: the "bounce unknown virtual user" code was in the
	wrong place. Problem tackled with help of Chip Christian.

	Portability: reportedly, Solaris 2.5.1 can hang waiting
	for a UNIX-domain connection to be accepted, so it gets
	the same workaround that was designed for LINUX. Problem
	reported by Scott Cotton.


	Management: "vmailer stop" now allows delivery agents to
	finish what they are doing, like "vmailer reload".

	Management; "vmailer abort" causes immediate termination.

	Workaround: zombie processes pile up with HP-UX. Reason:
	select() does not return upon SIGCHLD when SA_RESTART is
	specified to sigaction(). Workaround: shorten the select()
	timer to 10 seconds, #ifdef BRAINDEAD_SELECT_RESTARTS.
	Thanks, Lamont Jones.


	Rename: VMailer is now Postfix. Sigh.


	Cleanup: generalized the safe_open() routine so that it is
	no longer limited to mailbox files, lock files, etc.

	Bugfix (found during code review): vstream*printf() could
	run off the end of a stream buffer after an I/O error,
	because vbuf_print() ignored the result from VBUF_SPACE().

	Bugfix (found during code review): resolve_local() could
	clobber its argument, but the docs didn't say so.


	Cleanup: the is_header() routine now allows 8-bit data in
	header labels.


	Bugfix (found during code review): the mail_queue_enter()
	path argument wasn't optional.  File: global/mail_queue.c


	Cleanup: eliminated redundant tests for a zero result from
	vstream_fdopen(). Unlike the stdio fdopen() routine, the
	vstream_fdopen() routine either succeeds or never returns.

	Bugfix: the queue manager now looks at the clock before
	examining a file time stamp, to avoid spurious complaints
	about time warps on busy machines. File:  qmgr/qmgr_active.c.


	Compatibility: allow trailing dot at the end of user@domain.
	Address canonicalization now strips it off. Issue brought
	forward by Eilon Gishri. File: trivial-rewrite/rewrite.c.

	Robustness: changed DNS lookup order of MAIL FROM etc.
	domains from MX then A to A then MX, just in case the MX
	lookup fails with a server error.

	Renamed vmcat, vmlock, vmlogger, vmtrigger to postcat,
	postlock, postlog, postkick. Also renamed mkmap and mkalias
	to postmap and postalias.


	Workaround: Lamont Jones found a way for HP-UX to terminate
	select() after SIGCHLD. The code is #ifdef USE_SIG_RETURN.
	Files:  util/sys_defs.h, master/master_sig.c.

	Bugfix: the Delivered-To: loop detection code had stopped
	working, when long ago the is_header() routine was changed.
	File: local/delivered.c.


	Bugfix: postcat opened queue files read-write, where only
	read access was needed. File: postcat/postcat.c.


	Safety: added a sleep(1) to all fatal and panic exits.
	File: util/msg.c.


	Robustness: postcat now insists that a file starts with a
	time record.

	Consistency: added "-c config_dir" command-line options
	where appropriate.


	Man pages, on-line version.


	Man pages, html version; overview documentation.


	Sendmail silently accepted the unsupported -qRsite and
	-qSsite options.  It now prints an error message and

	Separated the contributed tree from the IBM code; moved
	the LDAP and NEXTSTEP/OPENSTEP code to the contributed
	source tree because obviously I didn't write it.


	Had to write a postconf configuration utility in order to
	reliably find out about all configuration parameters and
	their defaults.

	Documentation bugfixes by Matt Shibla, Scott Drassinower,
	Greg A. Woods.


	On machines with short hostnames, postconf -d cored while
	reporting a fatal error. It should not report that error
	in the first place. Thanks, Eilon Gishri.

	Changed the FAQ entry about rejecting mail for *.my.domain
	on a firewall. Chip Christian was right, I was wrong.


	Portability: with GNU getopt, optind is not initially 1,
	breaking an assumption in sendmail/sendmail.c. Liviu Daia.

	Annoyance: on non-networked systems, don't warn that only
	one network interface was found. File:  global/inet_addr_local.c.
	Reported by several.

	Bugfix: on non-networked systems, the smtp client assumed
	that it was running in virtual host mode, and would bind
	to the loopback interface. File smtp/smtp_connect.c.  Liviu
	Daia, again.


	Robustness: when looking up an A or MX record, do not give
	up when the A query fails because of a server error.  File
	dns/dns_lookup.c. Reported by Scott Drassinower.


	Bugfix: "bounce mail for non-existent virtual user" didn't
	work when a non-default relay host was configured in main.cf
	or in the transport table. File: qmgr/qmgr_message.c.

	Bugfix: the maildrop directory should not be world-readable.
	Files: conf/postfix-script, showq/showq.c.

	Documentation: fixed several omissions and errors.

	Documentation: removed references to the broken recipient
	feature delimiter configuration parameter.

	Bugfix: write mailbox file as the recipient, so that file
	quota work as expected.

	Bugfix: pickup would die when it tried to remove a non-file
	in the maildrop directory (Jeff Wolfe).


	Sendmail no longer logs the queue ID when it is unable to
	notify the pickup daemon. This is a late addition to the
	"unreadable maildrop queue" patch.

	user.lock files are now created as root, so that postfix
	needs no group directory write permission.


	Security: allow queue file link counts > 1, to avoid
	non-delivery of maildrop files with links to a non-maildrop
	directory.  Files:  global/mail_open_ok.c, and anything
	that calls this code (qmgr, pickup, showq). If multiple
	hard links are a problem, see the set-gid "postdrop" utility


	Robustness: the queue manager no longer aborts when a queue
	file suddenly disappears (e.g. because the file was removed
	by hand).

	Feature: when a writable maildrop directory is a problem,
	sites can make the new "postdrop" utility set-gid. This
	command is never used when the maildrop directory is

	Robustness: make the queue file creation routine more
	resistant against denial of service race attack. File:


	New suid_priv module to enable/disable privileges in a
	set-uid/gid program. In the end I decided to not use it.


	Robustness: make the pickup daemon more resistant against
	non-file race attack.

	Cleanup: generic mail_stream.c interface for writing queue
	file streams to files, daemons or commands. This simplifies
	the code in smtpd and in sendmail that must be able to pipe
	mail through the postdrop command. The cleanup daemon has
	been modified to use the same interface. Result: less code.

	Feature: smtpd now logs the only recipient in Received:

	Feature: separate command and daemon directories. Both
	default to $program_directory. Install conf/postfix-script
	if you want to use this feature.


	Patch to avoid conflict with non-writable top-level Makefile
	(Lamont Jones).


	Portability: port to UnixWare 7 by Ronald Joe Record, SCO.


	Bugfix: fencepost (Jon Ribbens, Oaktree Internet Solutions
	Ltd.) Files: quote_82[12]_local.c.

	Bugfix: wrong default for relay_domains (Juergen Kirschbaum,
	Bayerische Landesbank). File: mail_params.h.

	Bugfix: changed 5xx response for "too may recipients" to
	4xx. File: smtpd.c.


	Feature: defer_transports specifies the names of transports
	that should be used only when "sendmail -q" (or equivalent)
	is issued. For example, "defer_transports = smtp" is useful
	for sites that are disconnected most of the time. File:


	Feature: local_command_shell specifies a non-default shell
	for delivery to command by the local delivery agent. For
	example, "local_command_shell = /some/where/smrsh -c"
	restricts what may appear in "|command" destinations.
	File: global/pipe_command.c.


	Feature: SMTP command pipelining support based on an initial
	version by Jon Ribbens, Oaktree Internet Solutions Ltd.
	This one took several days of massaging before I felt
	comfortable about it. Files: smtp.c, smtp_proto.c.

	Bugfix: the SMTP server would flush responses one-by-one,
	which caused suboptimal performance with pipelined clients.
	The vstream routines now flush the write buffer when the
	read() routine is called, instead of flushing when the
	application changes from writing to reading. Delayed flush
	prevents the SMTP server from flushing responses one-by-one
	and thus triggering Nagle's algorithm. File: util/vstream.c.


	Bugfixes and enhancements to the smtpstone tools by Drew
	Derbyshire, Kendra Electronic Wonderworks: send helo command,
	send message headers, format the message content to lines
	< 80, work around NT stacks, make "." recognition more
	robust. Files: smtp-source.c, smtp-sink.c.

	Strategy: look at the deferred queue only when the incoming
	queue is empty; limit the number of recipients read from
	a queue file depending on the number of recipients already
	in core. Files: qmgr.c, qmgr_message.c.

	Feature: postponed anti-UCE restrictions. The decision to
	reject junk mail on the basis of the client name/address,
	HELO hostname or sender address can now be postponed until
	the RCPT TO command (or HELO or MAIL FROM if you like).
	File: smtpd_check.c.


	Feature: incremental updates of alias databases and of
	other lookup tables. Both postalias and postmap now take
	a -i option for incremental updates from standard input.
	Files: global/mkmap_*.c, post{map,alias}/post{map,alias}.c.

	Compatibility: newaliases can now update multiple alias
	databases: list them in the "alias_database" parameter in
	main.cf. By the same token, postalias can now update multiple
	maps in one command. Files:  post{map,alias}/post{map,alias}.c

	Feature: mail to <> is now sent to the address specified
	with the "empty_address_recipient" configuration parameter
	which defaults to MAILER-DAEMON (idea by Lamont Jones,
	Hewlett-Packard). File: cleanup/cleanup_envelope.c.

	Compatibility: the transport table now uses .domain.name
	to match subdomains, just like sendmail mailer tables (patch
	by Lamont Jones, Hewlett-Packard).

	Feature: mailq now ends with a total queue size summary
	(Eilon Gishri, Israel Inter University Computation Center).


	Feature: address masquerade exceptions for user names listed
	in the "masquerade_exceptions" configuration parameter.
	File: cleanup/cleanup_masquerade.c.

	Feature: qmail-style maildir support, based on initial code
	by Kevin W. Brown, Quantum Internet Services Inc.

	Workaround: Solaris 2.something connect() fails with
	ECONNREFUSED when the system is busy (Chris Cappuccio,
	Empire Net). File: global/mail_connect.c.

	Feature: the cleanup service now adds a Return-Path: header
	when none is present. This header is needed for some mail
	delivery programs (see below). File: cleanup_message.c.

	Feature: the pipe mailer now supports $user, $extension
	and $mailbox macros in command-line expansions. This, plus
	the Return-Path: header (see above), should be sufficient
	to support cyrus IMAP out of the box. Based on  initial
	code by Joerg Henne, Cogito Informationssysteme GMBH.
	File: pipe/pipe.c.

	Bugfix: with address extensions enabled, canonical and
	virtual lookups now are done in the proper order:
	user+foo@domain, user@domain, user+foo, user, @domain.
	File: global/mail_addr_find.c.


	Feature: the local mailer now prepends a Received: message
	header with the queue ID to forwarded mail, in order to
	make message tracing easier.  File: local/forward.c.

	Cleanup: after "postfix reload", no more broken pipe
	complaints from resolve/rewrite clients.


	Feature: pickup (again) logs uid and sender address.  On
	repeated request by Scott Cotton, Internet Consultants
	Group, Inc.

	Portability: doze() function for systems without usleep().

	Cleanup: clients are now consistently logged as host[address].


	Maildir support changed: specify "home_mailbox = Maildir/".
	The magic is the trailing /. Suggested by Daniel Eisenbud,
	University of California at Berkeley.

	Maildir support from aliases, :include: and .forward files.
	Specify /file/name/ - the trailing / is required. Suggested
	by Daniel Eisenbud, University of California at Berkeley.

	Workaround: watchdog timer to prevent the queue manager
	from locking up on some systems.

	Bugfix: in Received: headers, the "for <recipient>"
	information was in the wrong place. Pointed out by Jon
	Ribbens, Oaktree Internet Solutions Ltd.


	Portability: more workarounds for GNU getopt() by Liviu
	Daia, Institute of Mathematics, Romanian Academy. File:


	Bugfix: Postfix should not masquerade recipient addresses
	extracted from message headers. Problem reported by David
	Blacka, Network Solutions. File: cleanup/cleanup_message.c.


	Feature: smtpd_etrn_restrictions parameter to restrict who
	may use ETRN and what domains may be specified.  Example:
	"smtpd_etrn_restrictions = permit_mynetworks, reject".
	Requested by Jon Ribbens, Oaktree Internet Solutions Ltd.
	File: smtpd/smtpd_check.c.


	Bugfix: in an attempt to shave some cycles, the anti junk
	mail routines would use the wrong resolved address. This
	"optimization" is now turned off. Problem reported by Sam
	Eaton, Pavilion Internet Plc. File: smtpd/smtpd_check.c.

	Feature: BIFF notifications.  For compatibility reasons
	this feature is on by default.  This "protocol" can be a
	real performance pig.  Specify "biff = no" in main.cf if
	your machine has lots of shell users. Feature requested by
	Dan Farmer - it's one of the things one does for friends.
	Files:  local/mailbox.c, local/biff_notify.c.

	Bugfix: another case sensitivity problem, this time with
	virtual lookups to recognize unknown@virtual.domain.
	Problem reported by Bo Kleve, Linkoping University. File:


	Feature: with "soft_bounce = yes", defer delivery instead
	of bouncing mail. This is a safety net for configuration
	errors with delivery agents. It has no effect on errors in
	virtual maps, canonical maps, or in junk mail restrictions.
	Feature requested by Bennett Todd. File: global/bounce.c.


	Compatibility: the qmail maildir.5 documentation prescribes
	maildir file names of the form time.pid.hostname, which is
	wrong because Postfix processes perform multiple deliveries.
	Elsewhere the qmail author has documented how maildir files
	should be named under such conditions. Postfix has been
	changed to be conformant. File: local/maildir.c.


	Feature: special treatment of owner-foo and foo-request
	can be turned off. Specify "owner_request_special = no".
	Requested by Matthew Green and others. Files: local/alias.c,
	global/split_addr.c. This affects canonical, virtual and
	alias lookups.


	Portability: signal handling for HP-UX 9 by Lamont Jones
	of Hewlett Packard. File: master/master_sig.c.

	Robustness: disable random walk inside a per-site queue to
	avoid message starvation under heavy load. File: qmgr_entry.c.

	Robustness: under some conditions the queue manager could
	declare a host dead after just one delivery failure.  File:


	Feature: skip SMTP servers that greet us with a 4XX status
	code. Example: "smtp_skip_4xx_greeting = yes". By default,
	the Postfix SMTP client defers delivery when a server
	declines talking to us. File:  smtp/smtp_connect.c.

	Robustness: upon startup the queue manager now moves active
	queue files to the incoming queue instead of the deferred
	queue, to avoid anomalous delivery delays on systems that
	have a huge incoming queue.  Files: qmgr/qmgr.c,
	qmgr/qmgr_active.c, global/mail_flush.c, conf/postfix-script*


	Robustness: added watchdog timers to avoid getting stuck
	on systems with broken select() socket implementations.
	File: qmgr_transport.c, qmgr_deliver.c.


	Feature: NFS-friendly delivery to mailbox by avoiding the
	use of root privileges as much as possible. With input by
	Mike Muus, Army Research Lab, USA.

	Feature: the smtp-sink test server now supports SMTP command
	pipelining. To this end we had to generalize the timer and
	vstream support. Poor performance is fixed 19990222.

	Cleanup: timer event routines now have the same interface
	as read/write event routines (event type + context). File:

	Feature: new vstream_peek() routine to tell how much unread
	data is left in a VSTREAM buffer. This is the vstream
	variant of the peekfd() routine for kernel read buffers.
	File: util/vstream.c.

	Feature: directory scanning support for hashed mail queue
	directories. So far the results are disappointing: with
	depth = 2 (16 directories with 16 subdirectories), mailq
	takes 5 seconds with an empty queue unless all directories
	happen to be cached in memory.  We need a bit map before
	hashed queue directories become practical. Depth=1 hashing
	doesn't slow down mailq much, but doesn't help much either.
	Files: util/scan_dir.c, global/mail_scan_dir.c.


	Workaround: with "ignore_mx_lookup_error = yes", the SMTP
	client always performs an A lookup when an MX lookup could
	not be completed, rather than treating MX lookup failure
	as a temporary error condition.  Unfortunately there are
	many broken DNS servers on the Internet. File: smtp/smtp_addr.c.


	Performance: rewrote the guts of the smtp-sink test server
	so it can do pipelining without losing performance.


	Workaround: hotmail.com sometimes drops the connection
	after "." (causing misleading diagnostics to be logged) or
	waits minutes after receiving QUIT. Solution: do not wait
	for the response to QUIT. File: smtp/smtp_proto.c.  This
	is turned off with: "smtp_skip_quit_response = no".


	Feature: the pipe mailer accepts user=username:groupname,
	based on code submitted by Philip A. Prindeville, Mirapoint,
	Inc., USA.  File: pipe/pipe.c.

	Workaround: use file locking to prevent multiple processes
	from select()ing on the same socket. This causes performance
	problems on large BSD systems. Files: master/*_server.c.


	Bugfix: with "inet_interfaces =", don't bind to
	the loopback interface. Problem reported by Steve Bellovin
	of AT&T. File: smtp/smtp_addr.c.

	Feature: "postsuper" command to remove stale queue files
	to update queues after changes to the queue structure
	parameters (hash_queue_names, hash_queue_depth). This
	command is to be run from the postfix-script maintenance
	shell script.


	Feature: new postconf -h (suppress `name = ' in output)
	option to make the program easier to use in, e.g., shell

	Feature: dict_unix module so you can add the UNIX passwd
	table to the SMTPD access control list.


	Feature: "luser_relay = destination" captures mail for
	non-existent local recipients. This works only when the
	local delivery agent does mailbox delivery (including
	delivery via mailbox_command), not when mailbox delivery
	is delegated to another message transport.

	Feature: new reject_non_fqdn_{hostname,sender,recipient}
	restrictions to require fully.qualified.domain forms in
	HELO, MAIL FROM and RCPT TO commands (while still allowing
	the <> sender address).


	Bugfix: backed out the 19990119 change to always insert
	Return-Path:  if that header is not present. The pipe and
	local agents now are responsible for prepending Return-Path:.
	Files:  cleanup/cleanup_message.c, global/mail_copy.[hc],
	pipe/pipe.c, global/header_opts.c.  This causes an incompatible
	change to the pipe flags parameter, because Return-Path:
	now must be requested explicitly.


	Bugfix: showq (the mailq server) incorrectly assumed that
	all recipients of a deferred message are listed in the
	corresponding defer logfile. It now lists all recipients.
	Files: showq/showq.c, cleanup/cleanup_envelope.c (ensure
	that sender records always precede recipient records).

	Cleanup: smtpd HELO restrictions validate [numerical] forms.
	Files: util/valid_hostname.c, smtpd/smtpd_check.c.  Initial
	code by Philip A. Prindeville, Mirapoint, Inc., USA.


	Cleanup: re-vamped the valid_hostname module, and added a
	maximal label length (63) requirement.

	Feature: fallback_relay parameter to specify extra backup
	hosts in case the regular relay hosts are not found or not
	available.  Files:  smtp/smtp_addr.c.

	Feature: "always_bcc = address" specifies where to send a
	copy of each message that enters he system. However, if
	that copy bounces, the sender will be informed of the
	bounce. Files: smtpd/smtpd.c, pickup/pickup.c

	Compatibility: the transport map will now route on top-level
	domains, so you can dump all of .bitnet to a bitnet relay.


	Feature: LDAP lookups, updated by Jon Hensley, Merit Network,

	Feature: regular expression (PCRE) support by Andrew
	McNamara, connect.com.au Pty. Ltd., Australia. In order to
	use this code specify pcre:/file/name. You can use this
	anywhere you would use a DB or DBM file, NIS or LDAP.  See:
	PCRE_README for how to enable this code.

	Feature: "delay_warning_time = 4" causes Postfix to send
	a "your mail is delayed" notice after approx. 4 hours.
	Daniel Eisenbud, University of California at Berkeley.
	Files:  qmgr/qmgr_active.c, qmgr/qmgr_message. Postmaster
	notices for delayed mail are disabled by default. In order
	to receive postmaster notices, specify "notify_classes =
	...  delay ...".

	Cleanup: do not send undeliverable bounced mail to postmaster.
	This was causing lots of pain with junk mail from bogus
	sender addresses to non-existent recipients.  This change
	was reversed 19990311.


	Bugfix: the dotforward routine was too eager with throwing
	away extension information, so that the Delivered-To: info
	would differ for \mailbox and |command. Problem reported
	by Rafi Sadowski, Open University, Israel.

	Bugfix: seems I never got around to fix the btree access
	method. I finally did. Problem reported by: Matt Smith,
	AvTel Communications Inc., USA.


	Back by popular demand: with "notify_classes = 2bounce ..."
	Postfix will send undeliverable bounced mail to postmaster.
	The default is to not send double bounces.  This change
	reverses a change made on 19990307.


	Feature: configurable exit handler for server skeletons.
	Philip A.  Prindeville, Mirapoint, Inc., USA. Files:

	Feature: mail_spool_directory configuration parameter to
	specify the UNIX mail spool directory.  The default setting
	is system dependent.


	Cleanup: share file descriptors for resolve and rewrite
	client connections. This puts less strain on the trivial-rewrite

	Portability: support for UnixWare 2.1 by Dmitry E. Kiselyov,
	Nizhny Novgorod City Health Emergency Station.

	Feature: configurable delays in the smtpstone test programs.
	With input by Philip A.  Prindeville, Mirapoint, Inc., USA.
	Files:  smtpstone/*.c.

	Bugfix: a "signal 11" problem in the trivial-rewrite program
	that would occasionally happen after "postfix reload".
	Reason: some rewrite clients would clobber their input,
	and when they had to retransmit the query, the input would
	be a zero-length string, which trivial-rewrite isn't supposed
	to receive.


	Feature: "mailbox_transport = cyrus" delegates all local
	mailbox delivery to a master.cf entry called "cyrus" (the
	same trick for procmail), including users not found in the
	UNIX passwd database.  This gives the flexibility of $name
	expansions by the pipe mailer, without losing local aliases
	and ~/.forward processing.  Result of discussions with Rupa
	Schomaker, RS Consulting.


	Feature: the mydestination parameter can now be an empty
	string, for hosts that don't receive any mail locally. Be
	sure to specify a default route for mail that comes to the
	machine or mail will loop.


	Bugfix: the SMTPD check scaffolding didn't apply the same
	sanity checks as the production code. Problem reported by
	Alain Thivillon, Herve Schauer Consultants, France. File:

	Portability: some systems can have more than 59 seconds in
	a minute. Based on a fix by Liviu Daia, Institute of
	Mathematics, Romanian Academy.  File:  global/mail_date.c.

	Enhancement: include the client network address in the
	rejected by RBL response. Lamont Jones, Hewlett-Packard.

	Workaround: use fstat() to figure out if the maildrop is
	world-writable. access() uses the real uid, which stinks.

	Robustness: don't do partial address lookups (user@, domain,
	user, @domain) with regexp-style tables.

	Security: don't allow regexp-style tables to be used for
	aliases. It would be too easy to slip in "|command" or
	:include: or /file/name.


	Feature: "fallback_transport = cyrus" delegates non-UNIX
	recipients to a master.cf entry called "cyrus", allowing
	you to have both UNIX and non-UNIX mailboxes side by side.


	Workaround: on 4.4 BSD derivatives, fstat() can return
	EBADF on an open file descriptor. Now, that was a surprise.
	This caused std{out,err} from cron commands to not be

	Bugfix: "local -v" stopped working.

	Workaround: more watchdog timers for postfix-unfriendly
	systems. By now every Postfix daemon has one. Call it life

	Robustness: increased the maximal time to receive or deliver
	mail from $ipc_timeout (default: 3600 seconds) to the more
	generous $daemon_timeout (default: 18000 seconds). We don't
	want false alarms.

	Portability: IRIX 5.2 does not have usleep().


	Bugfix: \username was broken. Frank Dziuba was the first
	to notice.


	Workaround: from now on, Postfix on Solaris uses stream
	pipes instead of UNIX-domain sockets. Despite workarounds,
	the latter were causing more trouble than anything else on
	all systems combined.


	Portability: the makedefs would mis-identify IRIX 6.5.x as
	IRIX 5.x. Fix by Brian Truelsen of Maersk Mc-Kinney Moller
	Institute for Production Technology, Denmark.

	Feature: reject_unknown_recipient_domain restriction for
	recipient addresses. For the sake of symmetry, we now also
	have reject_unknown_sender_domain. This means the old
	reject_unknown_address restriction is being phased out.
	Suggested by Rask Ingemann Lambertsen, Denmark Technical

	Feature: unknown sender/recipient domain restrictions now
	distinguish between soft errors (always: 450) and hard
	errors (configurable with the unknown_address_reject_code
	parameter, default: 450; use 550 at your own risk).

	Feature: no HELO junk mail restrictions means that no syntax
	check will be done on HELO/EHLO hostname arguments.

	Bugfix: the initial Solaris workaround for UNIX-domain
	sockets could cause the queue manager to block if Postfix
	ran into a delivery agent process limit. After another code
	rewrite that problem is eliminated.  Thanks to Chris
	Cappuccio, Empire Net, for assistance with testing.


	Bugfix: too much forwarding when users list their own name
	in their .forward file (e.g. mail to user@localhost would
	go through .forward, would be forwarded to user@$myorigin,
	and would go through .forward again). Problem reported by
	Roman Dolejsi, Prague University of Economics.


	Bugfix: missing map name in check_xxx_access restrictions
	could cause a segmentation error. Lamont Jones, Hewlett-

	Feature: forward_path configuration parameter (default:
	Based on initial code by Philip A.  Prindeville, Mirapoint,
	Inc., USA.  Files:  local/dotforward.c.


	Workaround: Solaris NIS alias maps need special entries
	(YP_MASTER_NAME, YP_LAST_MODIFIED). What's worse, normal
	keys/values include a null byte at the end, but the YP_XXX
	ones don't. Problem reported by Walcir Fontanini, state
	university of Campinas, Brazil.  File: postalias/postalias.c.

	Compatibility: Solaris NIS apparently does include a null
	byte at the end of keys and values. File: util/sys_defs.h.

	Feature: library support for config parameters that are
	not $name expanded at program start-up. This was needed
	for forward_path, and will also be needed to make message
	headers customizable.

	Bugfix: pcre didn't handle \\ right. Lamont Jones, Hewlett-
	Packard. File: util/dict_pcre.c.


	Compatibility: Postfix now puts two spaces after the sender
	in a "From sender date..." header. Found by John A. Martin,
	fixed by Lamont Jones, Hewlett-Packard.

	Bugfix: when a recipient appeared multiple times in a local
	alias or include expansion, the delivery status could be
	left uninitialized, causing the mail to be deferred and
	delivered again. File: local/recipient.c.


	Cleanup: the dictionary routines now take an extra flag
	argument to control such things as warning about duplicates,
	and appending null bytes to key/value. The latter was needed
	for a clean implementation of NIS master alias maps support.

	Feature: POSIX regular expressions by Lamont Jones. See
	config/sample-regexp.c. Right now, enabled on *BSD and
	LINUX only.


	Code cleanup: dictionaries now have flags that say whether
	lookup keys are fixed strings or whether keys are subjected
	to pattern matching. This is needed to avoid passing partial
	addresses to regexp-based lookup tables (user, @domain,
	user@, domain). Files: util/dict*.c.

	Bugfix: fixed memory leaks and core dumps in the regexp
	and pcre routines (neither handled an empty pattern file).


	Code cleanup: the dictionary I/O routines now do their own
	locking depending on dictionary flag settings. This means
	that the low-level dict_get() interface can now be used
	for safe dictionary lookups. This is needed for 19990328's
	partial lookup key support. Files: util/dict*.c. global/maps.c.

	Feature: regular expression matches are no longer limited
	to user@domain address forms in access/canonical/virtual
	maps, but can also be used for domains in transport maps.
	This needed the partial lookup key support to avoid passing
	partial addresses to regexp-based lookup tables (user,
	@domain, user@, domain). Files: global/maps.c

	Feature: new dictionary types can be registered with
	dict_open_register(). File: util/dict_open.c.


	Bug fix: match_list membership dictionary lookups were case
	sensitive when they should not. Patch by Lutz Jaenicke,
	BTU Cottbus, Germany.


	Feature: $domain macro support in forward_path.  Philip A.
	Prindeville, Mirapoint, Inc., USA.  File:  local/dotforward.c.

	Feature: if an address extension (+foo) is explicitly
	matched by the .forward+foo file name, do not propagate
	the extension to recipient addresses. This is more consistent
	with the way aliases are expanded. File:  local/dotforward.c.


	Bugfix: after receiving mail, the SMTP server didn't reset
	the cleanup error flag, so that multiple deliveries over
	the same SMTP session could fail due to errors with previous
	deliveries. Found by Lamont Jones, Hewlett-Packard.


	Feature: MIME-encapsulated bounces. Philip A.  Prindeville,
	Mirapoint, Inc., USA.  File:  bounce/bounce_notify_service.c

	Cleanup: vstreams now properly look at the EOF flag before
	attempting to read, eliminating the need for typing Ctrl-D
	twice to test programs; the EOF flag is reset after each
	unget or seek operation.  Files: util/vstream.c, util/vbuf.c.

	Feature: in preparation for configurable message headers
	the mac_parse() routine now balances the parentheses in
	${name} or $(name). We need this in order to support
	conditional expressions such as ${name?text} where `text'
	contains other ${name} expressions.


	Cleanup: changed MIME header information to make bounces
	more RFC 1892 compliant.


	Feature: "best_mx_transport = local" delivers mail locally
	if the local machine is the best mail exchanger (by default,
	mail is bounced with a "mail loops back to myself" error).

	Config: in order to make feature tracking easier the source
	code distribution now has a copy of the default settings
	in conf/main.cf.default.

	Feature: separate configurable postmaster addresses for
	single bounces (bounce_notice_recipient), double bounces
	(2bounce_notice_recipient), delayed mail (delay_notice_recipient),
	and for other mailer errors (error_notice_recipient).  The
	default for all is "postmaster".


	Workaround: on Solaris 2.x, the master appears to lose its
	exclusive lock on the master.pid file, so keep grabbing
	the lock each time the master wakes up from select().

	Robustness: don't flush VSTREAM buffers after I/O error.
	This prevents surprises when calling vstream_fclose() after
	truncating a mailbox to its original size.

	Portability: on LINUX systems, if <db_185.h> exists, don't
	look for <db/db.h>.

	Workaround: specify "sun_mailtool_compatibility = yes" to
	avoid clashes with the mailtool application. This disables
	kernel locks on mailbox files. Use only where needed.

	Portability: renamed readline to readlline, to avoid clashes
	with mysql.


	Bugfix: ignore temp queue files that aren't old enough.
	Problem reported by Vivek Khera, Khera Communications, Inc.

	Bugfix: fixed typo in dict_db.c that caused processes to
	not release DB shared locks.

	Feature: auto-detection of changes to DB or DBM lookup
	tables.  This avoids the need to run "postfix reload" after
	change to the smtp access table and other tables.

	Feature: regular expression checks for message headers.
	This requires support for POSIX or for PCRE regular
	expressions.  Specify "header_checks = regexp:/file/name"
	or "header_checks = pcre:/file/name", and specify
	"/^header-name:  badstuff/ REJECT" in the pattern file
	(patterns are case-insensitive by default).  Code by Lamont
	Jones, Hewlett-Packard.  It is to be expected that full
	content filtering will be delegated to an external command.


	Bugfix: auto-detection of changes to DB or DBM lookup tables
	wasn't done for TCP connections.


	Feature: $recipient expansion in forward_path.  Philip A.
	Prindeville, Mirapoint, Inc., USA.  File: local/dotforward.c

	Feature: the smtp client consistently treats a numerical
	hostname as an address. File: smtp/smtp_addr.c.


	Compatibility: support comment lines starting with # in
	$mydestination include files. This makes Postfix more
	compatible with sendmail.cw files. File: util/match_list.c.

	Feature: if your machines have short host names, specify
	"mydomain = domain.name", and you no longer have to specify
	"myhostname = host.domain.name". Files:  global/mail_params.c,


	Cleanup: bounce mail when a mailbox goes over file quota,
	instead of deferring delivery.  File:  local/mailbox.c.


	Feature: auto-detection of changes to DB or DBM lookup
	tables now includes the case where a file is unlinked.
	Philip A.  Prindeville, Mirapoint, Inc., USA.  File:


	Robustness: Lotus mail sends MAIL FROM: <@> instead of <>.
	Problem reported by Erik Toubro Nielsen, IFAD, Denmark.
	Files:  trivial-rewrite/rewrite.c (@ becomes empty address)
	and global/rewrite_clnt.c (allow empty response).

	Bugfix: showq could segfault when writing to a broken pipe.
	Problem reported by Bryan Fullerton, Canadian Broadcasting
	Corporation. Files: util/vbuf_print.c.

	Cleanup: got rid of the "fatal: write error: Broken pipe"
	message when mailq output is piped into a program that
	terminates early.

	Cleanup: bounce messages are multipart/mixed with the error
	report as part of the first message segment, because users
	had trouble extracting the delivery error report from the


	Cleanup: the default junk mail reject code is now 554
	(service unavailable) rather than 550 (user unknown).

	Folded in the updated dict_ldap.c module by John Hensley,
	Merit Network, USA.

	Folded in the vstream_popen.c updates by Philip A.
	Prindeville, Mirapoint, Inc., USA.  This copies a lot of
	code from pipe_command(); the next step is to trim that


	Workaround: renamed config.h to mail_conf.h etc. in order
	to avoid name collisions with LINUX (yes, they have a system
	include file called config.h). For compatibility with people
	who have written software for Postfix, there's a config.h
	that aliases the old names to the new ones. That file will
	go away eventually.


	Feature: error mailer, in order to easily bounce mail for
	specific destinations. In the transport table, specify:
	"host.domain    error:host.domain is unavailable". Too bad
	that the transport table triggers on destination domain
	only; it would be nice to bounce specific users as well.


	Cleanup: "disable_dns_lookups = yes" now should disable
	all DNS lookups by the SMTP client.


	Bugfix: with DBM files, Postfix was watching the "dir" file
	modification time for changes. It should be watching the
	"pag" file instead.


	Cleanup: all callbacks in the master to server API now pass
	on the service name and the application-specific argument
	vector. Files: master/*server.c.


	Feature: conditional macro expansion. ${name?text} expands
	to text when name is defined, otherwise the result is empty.
	${name:text} expands to text when name is undefined,
	otherwise the result is empty. File: util/mac_expand.c.

	Feature: conditional macro expansion of the forward_path
	configuration parameters of $user, $home, $shell, $recipient,
	$extension, $domain, $mailbox and $recipient_delimiter.
	Files:  local/dotforward.c, local/local_expand.c.


	Cleanup: eliminated misleading warnings about unknown HELO
	etc. SMTPD restrictions when the HELO etc. information is
	not available. File: smtpd/smtpd_check.c.


	Feature: all smtpd reject messages now contain the MAIL
	FROM and RCPT TO addresses, if available.


	Feature: conditional macro expansion of the luser_relay
	configuration parameter. It is no longer possible to specify
	/file/name or "|command" destinations. File: local/unknown.c.

	Cleanup: changed the mac_parse interface so that the
	application callback routine can return status information.
	Updated the dict_regexp and dict_pcre modules accordingly.

	Cleanup: changed the mac_expand interface so that the caller
	provides an attribute lookup routine, instead of having to
	provide a copy of all attributes upfront. Files:
	util/mac_expand.c, local/local_expand.c.

	Feature: control over how address extensions are propagated
	to other addresses. By default, propagation of unmatched
	address extensions is now restricted to canonical and
	virtual mappings. Specify "propagate_unmatched_extensions
	= canonical, virtual, alias, forward, include" to restore
	previous behavior.


	Feature: USER, EXTENSION, DOMAIN, RECIPIENT (entire address)
	and MAILBOX (address localpart) environment variables are
	exported to shell commands (including mailbox_command).

	Feature: new command_expansion_filter parameter to control
	what characters may appear in message attributes that are
	exported via environment variables.

	Cleanup: SMTPD reject messages are more informative, and
	more complete sender/recipient information is logged for
	the local sysadmin.


	Bugfix: missing MIME header in postmaster bounce notices.
	Found by Samuel Tardieu, Ecole Nationale Superieure des
	Telecommunications, France.

	Feature: UCE restrictions are always delayed until RCPT
	TO, VRFY or ETRN. To change back to the default specify
	"smtpd_delay_reject = no" in /etc/postfix/main.cf.

	Bugfix: missing duplicate filter call. This caused too many
	deliveries when a user is listed multiple times in an alias.
	Reported by Hideyuki Suzuki, School of Engineering, University
	of Tokyo. Backed out on 19990512 because it caused problems.
	Fixed 19990513 but needs further study.

	Feature: it is now possible to move queue files back into
	the maildrop queue, so that they can benefit from changes
	in canonical and virtual mappings. In order to make this
	possible, some restrictions on queue file contents were
	relaxed. Files: pickup/pickup.c, cleanup/cleanup_extracted.c.

	Feature: made a start with integrating Joerg Henne's
	dictionary extensions to remove entries and to iterate over
	entries. That code is almost four months old by now.


	Feature: added a "undeliverable postmaster notification
	discarded" warning when mail is dropped on the floor.
	Requested by Michael Hasenstein, SuSE, Germany.


	Bugfix: reject_non_fqdn_sender/recipient would pass
	user@[ip_address] regardless of destination. Eric Cholet
	had the honor of suffering from this one.


	More SMTP client logging for easier debugging: the smtp
	client now logs hostname[ip.addr], and logs every failed
	attempt to reach an MX host, not just the last one.


	Bugfix: emit a blank line before a MIME boundary; the line
	is part of the boundary. File: bounce/bounce_notify_service.c.
	Wolfgang Segmuller, IBM Research.


	Bugfix: the "is this the loopback interface" test was
	broken.  Reported by Claus Fischer @microworld.com.  File:

	Usability: added helpful warnings about restrictions that
	are being ignored after check_relay_domains, etc.

	Portability: Reliant Unix support by Gert-Jan Looy, Siemens,
	the Netherlands.


	Robustness: the postfix-script start-up procedure now
	detects a missing master program, avoiding misleading
	warnings that the mail system is already running.  Fix
	suggested by David E. Smith @technopagan.org.

	Portability: Mac OS X Server Port by Mark Miller @swoon.net.

	Feature: on systems that use dotlock files for mailbox
	locking, the local delivery agent now will attempt to use
	dotlock files when delivering to user-specified files.
	Dotlock files for user-specified destinations are created
	with the privileges of the user. For backwards compatibility,
	Postfix will attempt to create dotlocks for user-specified
	destinations only when the user has parent directory write

	Feature: specify "expand_owner_alias = yes" in order to
	use the right-hand side of an owner- alias, instead of
	using the left-hand side address. Needed by Juergen Georgi.


	Bugfix: the local delivery agent did not set user attributes
	when delivering to root, so that forward_path did not expand
	properly. Found by Jozsef Kadlecsik, KFKI Research Institute
	for Particle and Nuclear Physics, Hungary.  File:

	Bugfix: the unix:passwd.byname mechanism is not suitable
	for smtpd access control - the user name would have to end
	in @, or the access control software would have to be
	changed. Removed the example from the RELEASE_NOTES file.


	Bugfix: the smtp server did not reset the error flag after
	".". Found by James Ponder, Oaktree Internet Solutions Ltd.
	File: smtpd/smtpd.c.

	Bugfix: fencepost error in the doze() routine (an usleep()
	replacement for systems without one). Found by Simon J
	Mudd.  File: util/doze.c.


	Portability: support for AIX 3.2.5 (!) by Florian Lohoff

	Portability: Ultrix 4.3 support by Christian von Roques

	Feature: mysql support by Scott Cotton and Joshua Marcus,
	Internet Consultants Group, Inc. Files: util/dict_myqsl.*.


	Bugfix: Postfix is now distributed under the new IBM Public
	License (version 1, dated June 14, 1999).

	Feature: the Delivered-To: header can be turned off for
	delivery to command or file/mailbox. The default setting
	is:  "prepend_delivered_header = command, file, forward".
	Turning off the Delivered-To: header when forwarding mail
	is not recommended.


	Feature: the postlock command now returns EX_TEMPFAIL when
	the destination file is locked by another process.


	Workaround: in the SMTP client, move the "mail loops back
	to myself test" from the 220 greeting to the HELO response.
	This change does not weaken the test, and makes Postfix
	more robust against broken software that greets with the
	client hostname.


	Workaround: in the INSTALL file, use `&&' instead of `;'
	in (cd path; tar ...) pipelines because some UNIX re-invented
	shells don't bail out when cd fails. Matthias Andree


	Bugfix: $user was not set when delivering to a non-user.
	Found by Vladimir Ulogov @ rohan.control.att.com when
	configuring a luser_relay that contained $user.


	Robustness: add PATH statement to Solaris2 chroot setup
	script to avoid running the ucb commands. Problem found by
	Panagiotis Astithas @ ece.ntua.gr.


	Bugfix: don't claim a "mail loops to myself" error when
	the best MX host was not found in the DNS. Found by Andrew
	McNamara, connect.com.au Pty Ltd. File: smtp/smtp_addr.c.


	Feature: added "-c config_dir" support to the postconf
	command. This probably means that "-f file" will never be


	Bugfix: showq didn't print properly when listing a maildrop
	file.  Fix by: Andrew McNamara, connect.com.au Pty Ltd.
	File: showq/showq.c.

	Feature: added SENDER to the list of parameters exported
	to external commands. File: local/command.c. Code by: Lars
	Hecking, National Microelectronics Research Centre, Ireland.


	Bugfix: sendmail -t (extract recipients from headers) did
	not work when the always_bcc feature was turned on. Reported
	by: Denis Shaposhnikov @ neva.vlink.ru.

	Bugfix: "sendmail -bd" returns a bogus exit status (the
	child process ID). Fix by Lamont Jones of Hewlett-Packard.
	File:  sendmail/sendmail.c.


	Bugfix: null pointer dereference while rejecting VRFY before
	MAIL FROM. Found by Laurent Wacrenier @ fr.clara.net.


	Portability: more MacOS X Server patches; some NEXTSTEP/OPENSTEP
	code that had been removed for the first public beta release;
	NEXTSTEP/OPENSTEP now defaults to netinfo for the aliases
	database.  Submitted by Gerben Wierda.

	Portability: workaround for a FreeBSD 3.x active network
	interface without IP address by Pierre Beyssac @ enst.fr.
	File:  inet_addr_local.c.


	Workaround: sendmail now prints a warning when installed
	set-uid or when run by a set-uid command. Reportedly, the
	linuxconf software turns on the set-uid bit, which could
	open up a security loophole. File: sendmail/sendmail.c.

	Bugfix: Postfix daemons now temporarily lock DB/DBM files
	while opening them, in order to avoid "invalid argument"
	errors because some other process is changing the file.
	Files: util/dict_db.c, util/dict_dbm.c.

	Robustness: Postfix locks queue files during delivery, to
	prevent duplicate delivery when "postfix reload" is
	immediately followed by "sendmail -q". This involves a
	change of the deliver_request interface:  delivery agents
	no longer need to open and close queue files explicitly.
	Files:  global/deliver_request.c, pipe/pipe.c, smtp/smtp.c,
	local/local.c, qmgr/qmgr_active.c, qmgr/qmgr_message.c.

	Feature: reject_unauth_destination SMTP recipient restriction
	that rejects destinations not in $relay_domains.  By Lamont
	Jones of Hewlett-Packard.  File: smtpd/smtpd_check.c.

	Security: do not allow weird characters in the expansion
	of $names that appear in $forward_path. Just like with
	shell commands, replace bad characters in expansions by
	underscores.  Configuration parameter:  forward_expansion_filter.


	Documentation: added a sample postfix alias to the examples
	in the INSTALL document and in the conf/aliases file.
	Reminded by Simon J.  Mudd @ alltrading.com.


	Bugfix: in case of some error conditions the pickup daemon
	could leak small amounts of memory.


	Bugfix: no more "skipping further client input" warnings
	when a message header is rejected.

	Feature: reject_unauth_pipelining SMTP restriction that
	rejects mail from clients that improperly use SMTP command

	Robustness: the LDAP client by default no longer looks up
	names containing "*". See the lookup_wildcards feature in
	LDAP_README. Update by John Hensley.

	Documentation: address masquerading with exceptions FAQ by
	Jim Seymour @ jimsun.LinxNet.com.

	Bugfix: mysql reconnect after disconnect by Scott Cotton
	Internet Consultants Group, Inc. File: util/dict_myqsl.c.

	Portability: the Postfix to PCRE interface now expects
	version 2.08.  Postfix is no longer compatible with PCRE
	versions before 2.6.


	Feature: INSTALL.sh script that makes Postfix installation
	a bit less painful. This script can be used for installing
	and for upgrading Postfix. It replaces files instead of
	overwriting them, and leaves existing configuration and
	queue files intact.


	Bugfix: reject_non_fqdn_sender used the wrong test to see
	if a sender address was given and could dump core. This
	must have been broken ever since the UCE tests were moved
	to the RCPT TO stage in 19990510.

	Bugfix: check_sender_access was recognized as a valid
	restriction name only if a sender had been specified.


	Portability: Unixware has <sysexits.h> only after sendmail
	is installed. Changed postlock.c to use global/sys_exits.h.


	Performance: added one-entry cache to the address rewriting
	client and to the address resolving client. This is because
	UCE restrictions tend to produce the same query repeatedly.
	Files: global/rewrite_clnt.c, global/resolve_clnt.c.

	Feature: the UCE restrictions are now fully recursive so
	you can have per-client/helo/sender/recipient restrictions.
	Instead of OK, REJECT or [45]xx, you can specify a sequence
	of restrictions on the right-hand side of an SMTPD access
	table. This means you can no longer use canonical/virtual/alias
	maps as SMTPD access tables. But the loss is compensated
	for.  File: smtpd/smtpd_access.c.

	Feature: restriction classes, essentially a short-hand for
	restriction lists.  These short hands are useful mostly on
	the right-hand side of SMTPD access tables. You must use
	restriction classes in order to have lookup tables on the
	right-hand side of an SMTPD access table.  File:

	Feature: "permit_recipient_map maptype:mapname" permits a
	recipient address when it matches the specified table.
	Lookups are done just as with canonical/virtual maps.  With
	this, you can also use passwd/aliases as SMTPD access maps.
	File: smtpd/smtpd_access.c.


	Changed "permit_address_map" into "permit_recipient_map"
	and added a test for the case that they specify a lookup
	table on the right-hand side of an SMTPD access map.  File:

	Cleanup: removed spurious sender address checks for <>.
	File: smtpd/smtpd_check.c.

	Cleanup: the smtp client now consistently logs host[address]
	for all connection attempts.


	Feature: in an SMTPD access map, an all-numeric right-hand
	side now means OK, for better cooperation with out-of-band
	authentication mechanisms.


	Security: recipient addresses must not start with '-', in
	order to protect external commands. The old behavior is
	re-instated when main.cf specifies:  "allow_min_user =
	yes".  Credits to Mads Kiilerich @ Kiilerich.com.  File:

	Bugfix: after 19990831, the queue manager would throw away
	defer logs after deferring mail to known-to-be-dead hosts
	or message transports. This means that in some cases, mailq
	would not show why mail is delayed, and that delayed mail
	could be sent back with recipients missing from the error
	report. Reported by Giulio Orsero @ tiscalinet.it.


	Bugfix: the above bugfix broke bounces of mail with bad
	address syntax and relocated users. Problem diagnosed by
	Dick Porter @ acm.org.

	Documentation: added DO NOT EDIT THIS FILE. EDIT MAIN.CF
	INSTEAD notices to the sample-xxx.cf files.


	Compatibility: ignore the sendmail -U (initial user
	submission) option. Thomas Quinot @ cuivre.fr.eu.org.


	Code cleanup: don't send postmaster notifications when an
	SMTP client sends a DATA command while no recipients were
	accepted.  This can happen when a pipelined client runs
	into an UCE block. File:  smtpd/smtpd.c.


	Robustness: do not apply UCE header checks to mail that is
	generated by Postfix (bounces, forwarded mail etc.).  Files:
	smtpd/smtpd.c, pickup/pickup.c, cleanup/cleanup_message.c.

	Robustness: new generic watchdog module that can deal with
	clocks that jump occasionally. Files: util/watchdog.c,
	master/master.c, master/{single,multi,trigger}_server.c.
	This hopefully ends the false watchdog alarms that happen
	when clocks are set or when laptops are resumed.

	Code cleanup: BSMTP requires dot quoting as per RFC 821.
	Based on code by Florian Lohoff @ rfc822.org. Files:
	global/mail_copy.[hc], pipe/pipe.c.


	Bugfix: the crufty code in inet_addr_local() did not find
	IP aliases. File: util/inet_addr_local.c.

	Portability: the INSTALL.sh utility did not find users or
	groups in NIS or Netinfo tables. The script no longer
	searches the /etc/passwd and /etc/group files.  Instead it
	now queries the unix:passwd.byname and unix:group.byname
	maps.  For this, a -q (query) option was added to postmap
	(and to postalias, for symmetry).  Files: util/dict_unix.c,
	postalias/postalias.c, postmap/postmap.c, INSTALL.sh.

	Bugfix: LDAP lookup timeout settings were ignored. Patch
	by John Hensley. File: util/dict_ldap.c.


	Bugfix: when doing a fresh install, INSTALL.sh didn't set
	main.cf:mail_owner properly (Simon J. Mudd).


	Bugfix: when doing a fresh install, INSTALL.sh no longer
	worked (missing main.cf file).  Fix: add "-c" argument to
	the postmap commands (Lars Hecking @ nmrc.ucc.ie).

	Documentation: removed spurious "do not edit" comments from
	the sample pcre and regexp configuration files.


	Code cleanup: greatly simplified the SMTPD command parser
	and somewhat simplified the code that groks RFC 822-style
	address syntax in MAIL FROM and RCPT TO commands.

	New parameter: strict_rfc821_envelopes (default: no) to
	reject RFC 822 address forms (with comments etc.) in SMTP
	envelopes. By default, the Postfix SMTP server only logs
	a warning.


	Oops, also updated the SMTP VRFY code in the light of
	changes to the SMTPD command parser.

	Cleanup: the local delivery agent now explicitly rejects
	recipients with an empty username.


	Workaround: with some gawk versions, postconf/extract.awk
	reportedly returns a non-zero exit status upon success.
	Added an explicit exit(0) statement.


	Feature: DNS TXT record lookup support, based on initial
	code by Simon J Mudd.  File: dns/dns_lookup.c.

	Feature: RBL TXT record lookups, based on initial code by
	Simon J Mudd.  File: smtpd/smtpd_check.c.

	Feature: permit_auth_destination restriction based on code
	by Jesper Skriver @ skriver.dk.

	Code cleanup: the transport table now can override all
	deliveries, including local ones.


	Code cleanup: a new "local_transports" configuration
	parameter explicitly lists all transports that deliver mail
	locally. The first name listed there is the default local
	transport.  This is the end of the "empty next-hop hostname"
	hack to indicate that a destination is local.  Files:
	trivial-rewrite/resolve.c, global/local_transport.[hc]

	Feature: "postconf -m" shows what lookup table types are
	available.  Code by Scott Cotton, Internet Consultants
	Group, Inc.

	Feature: "postconf -e" edits any number of main.cf parameters.
	The edit is done on a copy, and the copy is renamed into
	the place of the original. File: postconf/postconf.c,


	Portability: SunOS 4 has no SA_RESTART. File: util/watchdog.c.

	Feature: on systems with h_errno, the "reject_unknown_client"
	restriction now distinguishes between soft errors (always
	reply with 450) and hard errors (use the user-specified
	reply code).  This should lessen the load by broken mailers
	that re-connect once a minute.

	Feature: forward/reverse name/address check for SMTP client
	hostnames. This fends off some hypothetical attacks by
	spammers who are in control of their own reverse mapping.

	Robustness: postconf no longer aborts when it can't figure
	out the local domain name; it prints a warning instead.
	This allows you to use "postconf -e" to fix the problem.


	Bugfix: the RFC822 address parser would misparse a leading
	\ as an atom all by itself. Problem reported by Keith
	Stevenson @ louisville.edu. File: global/tok822_parse.c.


	Bugfix: tiny memory leak in pipe_command() when fork()
	fails.  File: global/pipe_command.c.


	Bugfix: reversed test for all-numerical results in SMTPD
	access maps. File: smtpd/smtpd_check.c.


	Robustness: INSTALL.sh no longer uses postmap for sanity

	Feature: INSTALL.sh now has an install_root option.

	Bugfix: INSTALL.sh now installs manual pages with proper
	permissions and ownership.

	Bugfix: the LDAP client did not properly escape special
	characters in lookup keys (patch by John Hensley).  File:


	Bugfix: missing absolute path in INSTALL.sh broke fresh


	Bugfix: the local delivery agent's recipient duplicate
	filter did not work when configured to use unlimited memory
	(which is not a recommended setting). Patrik Rak @raxoft.cz.


	Bugfix: postconf didn't have an umask(022) call at the
	beginning (problem experienced by Matthias Andree).


	Bugfix: DNS TXT records now have string lengths before text
	(Mark Martinec @ nsc.ijs.si).


	Update: the LDAP client code now supports escapes as per
	RFC2254 (John Hensley).


	Performance: one message with many recipients no longer
	stops other mail from being delivered. The queue manager
	now frees in-memory recipients as soon as a message is
	delivered to one destination, rather than waiting until
	all in-memory destinations of that message have been tried.
	Patch by Patrik Rak @ raxoft.cz.  Files: qmgr/qmgr_entry.c,

	Performance: when delivering mail to a huge list of
	recipients, the queue manager now reads more recipients
	from the queue file before delivery concurrency drops too
	low.  Files:  qmgr/qmgr_entry.c, qmgr/qmgr_message.c.


	Updated LDAP client code by John Hensley with escape
	sequences as per RFC 2254. File: util/dict_ldap.c.

	Updated MYSQL client code by Scott Cotton. File: dict_mysql.c.

	Feature: added -N/-n options to include/exclude terminating
	nulls in keys and values in postmap/postalias DB or DBM
	files. Normally, Postfix uses whatever is appropriate for
	the host system.  A non-default setting can be necessary
	for inter-operability with third-party software.

	Bugfix: the local delivery agent would deliver to the user
	instead of the .forward file when the .forward file was
	already visited via some non-recursive path. Patch by Patrik
	Rak @ raxoft.cz. Files: global/been_here.c, local/dotforward.c.

	Robustness: attempt to deliver all addresses in the expansion
	of an alias or .forward file, even when some addresses must
	be deferred.  File: local/token.c.


	Performance: qmgr_fudge_factor controls what percentage of
	delivery resources Postfix will devote to one message.
	With 100%, delivery of one message does not begin before
	delivery of the previous message is completed. This is good
	for list performance, bad for one-to-one mail. With 10%,
	response time for one-to-one mail improves much, but list
	performance suffers. In the worst case, people near the
	start of a mailing list get a burst of postings today,
	while people near the end of the list get that same burst
	of postings a whole day later.  Files: qmgr/qmgr_message.c,

	Bugfix: address rewriting would panic on a lone \ at the
	end of a line where an address was expected. Jason Hoos @
	thwack.net. File: global/rewrite_clnt.c.


	Bugfix: the strict RFC821 envelope address check should
	not be applied to VRFY commands. File: smtpd/smtpd.c.

	Cleanup: permit_recipient_maps is gone, because that could
	only be used inside UCE restrictions.


	Feature: allow an empty inet_interfaces parameter, just
	like an empty mydestination parameter. It's needed for true
	null clients and for firewalls that deliver no local mail.

	Feature: "disable_vrfy_command = yes" disables some forms
	of address harvesting used by spammers.

	Workaround: added the alias map parameter definition to
	the smtpd code.  This is a symptom of a general problem
	with parameters that have non-empty default values:  unless
	a program explicitly defines such a parameter, the parameter
	defaults to the empty string when used in other parameters.
	There's also a problem with evaluation order.

	Feature: the SMTP server rejects mail for unknown users in
	virtual domains that are defined by Postfix virtual domain
	files. File: smtpd/smtpd_check.c.

	Feature: reject mail for unknown local users at the SMTP
	port.  The local_recipient_maps configuration parameter
	specifies maps with all addresses that are local with
	respect to $mydestination or $inet_interfaces. Example:
	"local_recipient_maps = $alias_maps unix:passwd.byname".
	This feature is disabled by default. You may have to copy
	the passwd file into the chroot jail. File:  smtpd/smtpd_check.c.

	Feature: the sendmail -f option now understands '<user>'
	and even understands address forms with RFC 822-style


	Cleanup: no more UCE checks for VRFY commands. It still
	reports unknown local/virtual users. File:  smtpd/smtpd_check.c.

	Robustness: upon Postfix startup, report discrepancies
	between system files inside and outside the chroot jail.
	Files: conf/postfix-script-nosgid, conf/postfix-script-sgid.


	Cleanup: INSTALL.sh produces relative symlinks, which is
	necessary when install_root is not /.


	Documentation: completely reorganized the FAQ and added
	many new entries. Rewrote the UCE html documentation.

	Cleanup: INSTALL.sh uses a configurable directory for
	scratch files, so that it can install from a file system
	that is not writable by the super-user.

	Cleanup: INSTALL.sh gives helpful hints when the "mv"
	command is unable to move symlinks across file system


	Cleanup: it is no longer necessary to list $virtual_maps
	as part of the relay_domains definition. The SMTP server
	now by default accepts mail for destinations that match
	$inet_interfaces, $mydestination or $virtual_maps, whether
	or not these are specified in relay_domains.  We still need
	the ugly "virtual.domain whatever" hack in the virtual
	maps. Files:  smtpd/smtpd_check.c and lots of documentation
	and sample config files.


	Removed cyrus -q flag (ignore quotas) from the sample
	master.cf file.


	Bugfix: smtpd should not check for unknown users when
	running in stand-alone (sendmail -bs) mode. Problem
	experienced by Chuck Mead.  File: smtpd/smtpd.c.

	Retraction: the "local_transports" configuration parameter
	is gone. Adjusted code and documentation accordingly.
	Instead, use just one "local_transport" parameter with the
	name of the default local transport. Files:  smtpd/smtpd_check.c,
	qmgr/qmgr_message.c, trivial-rewrite/ resolve.c, local/resolve.c.

	Feature: Postfix SMTPD now insists that the smtpd recipient
	restrictions contain at least one restriction that by
	default rejects mail. This should make it much more difficult
	to change Postfix into an open relay.  File:  smtpd/smtpd_check.c.

	Retraction: null-length inet_interfaces is too confusing.


	Bugfix: the relative symlink code in INSTALL.sh computed
	the ../ prefix from the wrong pathname.


	Feature: "allow_untrusted_routing = no" (default) prevents
	forwarding of source-routed mail from untrusted clients to
	destinations that are blessed by the relay_domains parameter
	(example:  user@domain2@domain1 etc.).  This plugs a mail
	relay loophole where a backup MX host forwards junk mail
	to a primary MX host which forwards the junk to the Internet.
	Files:  global/quote_822_local.c, smtp/quote_821_local.c,
	trivial-rewrite/rewrite.c, trivial-rewrite/resolve.c,

	In order to make this possible, the Postfix resolver data
	structure and protocol has changed, so that all resolver
	clients need to be re-compiled.

	Side effect from the above change: from now on, an address
	with @ in the recipient localpart no longer bounces with
	"user unknown" but instead is rejected with "relay access
	denied" or "source-routed relay access denied".


	Workaround: the BSD/OS "mkdir -p" and "cmp -s" commands
	misbehave on boundary cases: directory exists or file does
	not exist. Those who re-invent...


	Added the no source routing info requirement to addresses
	accepted by the permit_mx_backup UCE restriction.


	Added a spawn daemon (not compiled and installed by default)
	to enable LMTP delivery over UNIX-domain sockets. The goal
	is to simplify the experimental LMTP delivery agent by
	ripping out the privileged code that forks the LMTP server.


	Clarified documentation after early feedback on the 19991231
	release by Drew Derbyshire, Ollivier Robert, Khetan Gajjar.

	Sanity check: a common error is to list Postfix virtual
	domains in the mydestination parameter. This causes the
	new optional local_recipient_maps feature to reject mail
	for virtual users.  The SMTP server now explicitly tests
	for this common error and logs a warning instead of refusing
	the mail.  File:  smtpd/smtpd_check.c.


	Bugfix: a case sensitivity bug had slipped through in the
	anti-relaying code, causing mail for USER@VIRTUAL.DOMAIN
	to be rejected with "relay access denied". This was found
	by Jim Maenpaa @ jmm.com.

	Questionable feature: set "smtp_skip_5xx_greeting = yes"
	to make Postfix more sendmail compatible, even though this
	is wrong, IMNSHO. File: smtp/smtp_connect.c.

	Portability: Ultrix patch from Simon Burge @ thistledown.com.au.

	Portability: Siemens Pyramid (dcosx) patch by Thomas D.
	Knox @ vushta.com.

	Performance: FreeBSD has bidirectional pipes that are faster
	than socketpairs. Anticipating on more platform-specific
	optimizations, all duplex pipe plumbing is now isolated in
	a duplex_pipe.c module that provides a system-independent


	Cleanup: the INSTALL.sh script now updates the sample files
	in /etc/postfix even when main.cf exists.


	Bugfix: the SMTP server should consult the relocated map
	for virtual destinations (Denis Shaposhnikov). Files:
	smtpd/smtpd.c smtpd/smtpd_check.c.


	Workaround: rename() over NFS can fail with ENOENT even
	when the operation succeeds (Graham Orndorff @ WebTV). This
	is not news. Any non-idempotent operation can fail over
	NFS when the NFS server's acknowledgment is lost and the
	NFS client code retries the operation (other examples are:
	create, symlink, link, unlink, mkdir, rmdir).  Postfix has
	workarounds for the cases where this is most likely to
	cause trouble. Files:  util/sane_{rename,link}.[hc].  If
	you want reliable mail system, do not use NFS.


	Workaround: better detection of bad hardware. Added SIGBUS
	to the list of signals that the master will log before


	Portability: preliminary SCO5 port Christopher Wong @
	csports.com. This still needs to a workaround for "find"
	not supporting "-type s" (actually, UNIX-domain sockets
	have no unique representation in the file system and show
	up as FIFOs).


	Bugfix: in case of a too long message header, don't extract
	recipients from message headers.  With the previous behavior,
	Bcc information could be left in the message body, as one
	person found out the hard way.  Files:  cleanup/cleanup.c,
	cleanup/cleanup_extracted.c, global/cleanup_user.h.


	Whatever: RFC 1869 amends RFC 821 and specifies that code
	555 is to be used when a MAIL FROM or RCPT TO parameter is
	not implemented or not recognized. Russ Allbery @stanford.edu.
	This reply code is added to the list of reply codes that
	cause the Postfix SMTP client to mail a transcript to the
	postmaster.  File: smtp/smtp_trouble.c.


	Emergency feature: qmgr_site_hog_factor (default: 90 percent)
	limits the amount of resources that Postfix devotes to a
	single destination. With less than 100, Postfix defers the
	excess mail so that one site with a large backlog does not
	block other deliveries. Files: qmgr/qmgr.c, qmgr/qmgr_message.c.


	Cleanup: the queue manager no longer replaces the nexthop
	field by the recipient localpart when a destination matches
	$mydestination/$inet_interfaces. The price is the introduction
	of a new parameter local_destination_recipient_limit which
	defaults to 1 in order to maintain backwards compatibility.
	Files: qmgr/qmgr.c, qmgr/qmgr_message.c.


	Bugfix: extracted recipients were misfiled when a message
	was moved back to the maildrop queue. But they still worked
	due to a coincidence.

	Feature: bounce_recip() bounces a recipient immediately
	without accessing a bounce logfile.  This is necessary for
	VERP bounces, for bounces by delivery agents that change
	the sender address, and for bounces that for some reason
	must not use temporary logfiles.  Files: global/bounce.c,


	Bugfix: the too long header fix of 20000115-22 lost mail
	with too long headers that didn't need to extract recipients
	from message headers.

	Bugfix: the too long header fix of 20000115-22 lost mail
	without (blank line + message body).

	Code rewrite: reorganized the cleanup daemon source code
	so that the cleanup service can be called one record at a
	time (see cleanup/cleanup_api.c); also got rid of the global
	state variables and fixed a couple bugs that were introduced
	with 20000115-22.


	Feature: in daemon mode, the MAIL FROM size check can be
	postponed until RCPT TO so that Postfix can log sender and
	recipient. Simon J Mudd.  Files: smtpd/smtpd.c

	Robustness: limit the number of recipient addresses that
	can be extracted from message headers. Parameter:
	extract_recipient_limit (default:  10240). Files:
	cleanup/cleanup_message.c, cleanup/cleanup_extracted.c.

	Cleanup: the message header reject logging now includes
	sender and recipient address (if possible), so that the
	logging looks more like the other reject logging.  File:

	Documentation: added sections on regular expression tables
	to the access, canonical, virtual, transport and relocated
	man pages, and write new man pages that are specific to
	regular expressions: pcre_table.5 and regexp_table.5.


	Bugfix: postconf reported some parameters more than once
	because the parameter extracting script didn't recognize
	lines that differ in whitespace only. File: postconf/extract.awk.
	Reported by Kenn Martin.


	Logging: the SMTP client now logs log host+port when it is
	unable to connect to a non-MX host, just like it logs
	host+port when unable to connect to an MX host.


	Bugfix: the SMTP server's "User unknown" test didn't notice
	LDAP etc. dictionary access errors. The code now reports
	a 450 status (try again instead of bounce) if the reply is
	not definitive.  File: smtp/smtpd_check.c.

	Robustness: the smtp-source program could stall when making
	hundreds of parallel connections to a Postfix system with
	only one SMTP server process. The fix is to use non-blocking
	connect() calls, very carefully. File: smtpstone/smtp-source.c.


	Feature: with smtp_always_send_ehlo the SMTP client will
	send EHLO regardless of the content of the SMTP server's
	greeting.  File: smtp/smtp_proto.c.


	Feature: DICT_FLAG_SYNC_UPDATE flag for synchronous dictionary
	updates, if supported by the underlying mechanism. Files:
	util/dict.h, util/dict_open.c, util/dict_db.c.


	Cleanup: the manual pages in Postfix configuration files
	no longer contain troff formatting codes.  The text is now
	generated from prototype files in a new "proto" subdirectory.
	Requested by Matthias Andree @ stud.uni-dortmund.de.


	Bugfix: the unused db and dbm "delete" routines would
	clobber the per-dictionary flags when called before reading
	or writing the table. Files: util/dict_dbm.c, util/dict_db.c.
	Lutz Jaenicke @ aet.TU-Cottbus.DE.

	Bugfix: the SMTP server would produce a cryptic message
	when a queue file write error happened before it had written
	any recipients.  Keith Stevenson. File: smtpd/smtpd.c.

	Robustness: the db and dbm "delete" routines didn't adjust
	to dictionaries with/without one trailing null in lookup
	keys and values. Did a complete rewrite of the routines.
	Files: util/dict_db.c, util/dict_dbm.c.

	Feature: specify "-d key" to postalias or postmap in order
	to remove one key. This still needs to be generalized to
	multi-key removal (read stdin?). Files: postmap/postmap.c,

	Test: added test targets for the dictionary delete operations.
	Files: util/Makefile.in, util/dict_test.{c,in,ref}.

	Feature: added data offset and recipient count fields to
	the first queue file record output from the cleanup daemon.
	The recipient counts provides an initial estimate for a
	more advanced queue manager scheduling algorithm. Files:
	cleanup/cleanup_envelope.c, cleanup/cleanup_extracted.c.


	Portability: HP-UX awk can't handle bare { in regexps
	(Lamont Jones. HP). File: postconf/extract.awk.

	Compatibility: sendmail now recognizes '.' as end of input.
	File: sendmail/sendmail.c.


	Compatibility: dtcm (CDE desktop calendar manager) leaks
	a file descriptor into its child process, and requires that
	sendmail closes the descriptor, otherwise mail notification
	will hang.  These GUI programmers never figured out that
	the child process must close the writing end of a pipe.
	File:  sendmail/sendmail.c.


	Feature: SASL authentication in the SMTP server and client.
	Based on code contributed by Till Franke, SuSE.  Specify:
	"smtpd_sasl_auth_enable = yes" and "smtp_sasl_auth_enable
	= yes". The "permit_sasl_authenticated" UCE restriction
	gives special treatment to authenticated clients.


	Workaround: added -blibpath option for AIX 4.x, to close
	hole in case postdrop needs to be set-gid.


	Portability: FreeBSD 5.x added to the list of supported
	systems (Mark Huizer).


	Portability: INSTALL.sh looks if sendmail is in /usr/lib
	rather than in /usr/sbin.


	Bugfix: settings in one mysql configuration file would act
	as the implicit defaults for the next one, which could be
	confusing.  Patch by Scott Cotton. File: util/dict_mysql.c.

	Robustness: limit the number of "junk" commands that can
	be issued in an SMTP session (ex.: NOOP, VRFY, ETRN, RSET).
	Problem report by Michael Ju. Tokarev @ tls.msk.ru.  Files:
	global/mail_params.h, smtpd/smtpd.c.


	Portability: more MacOS X patches by Gerben Wierda.

	Bugfix: RFC 822 requires the presence of at least one
	destination message header. The cleanup daemon now generates
	a generic "To: undisclosed-recipients:;" message header
	when no destination header is present.  The header content
	is specified with the undisclosed_recipients_header parameter.
	Problem pointed out by Geoff Gibbs, UK-Human Genome Mapping
	Project-Resource Centre.


	Workaround: allow <(comment)> as SMTP MAIL FROM address.


	The SASL authentication in the SMTP server and client works,
	but only on Linux and Solaris, neither of which I wish to
	run on my laptop.


	Added LMTP support to the smtp-source and smtp-sink utilities
	so that I don't have to install Cyrus IMAP just to test


	Bugfix: removed the () from the tokenized representation
	of RFC 822 comments, so that comments with \( or \) can be
	unparsed correctly.  Problem reported by Bodo Moeller.


	Bugfix: mail_copy() could prepend > or . in the middle of
	long lines. Found by code inspection.


	New code: unescape module that translates C escape sequences
	into their equivalent character values.  File: util/unescape.c.

	Feature: the pipe mailer now has a way to specify the output
	record delimiter (for example, eol=\r\n). This is necessary
	for transports that require CRLF instead of UNIX-style LF.


	In order to support timeouts more conveniently, VSTREAMs
	now have built into them the concept of timeout.  Instead
	of calling read() and write(), the low-level VSTREAM
	interface now by default uses timed_read() and timed_write()
	which receive a timeout parameter; vstream_ctl(stream,
	VSTREAM_CTL_TIMEOUT...) sets the timeout deadline on a
	stream, and vstream_ftimeout(stream) queries a stream for
	timeout errors.  This change simplified timeout handling
	considerably.  Files: util/vbuf.h, util/vstream.[hc],
	global/smtp_stream.c, global/timed_ipc.c.


	Added application context to VSTREAMs, which is passed on
	transparently to application-provided read/write routines.
	vstream_ctl(stream, VSTREAM_CTL_CONTEXT...) sets the context.
	Files:  util/vstream.[hc].

	Added vstream_setjmp() and vstream_longjmp() support to
	make exception handling more convenient. Turn on exception
	handling with vstream_ctl(stream, VSTREAM_CTL_EXCEPT...).
	Files:  util/vstream.[hc].

	Cleaned up the smtp_stream module further and got rid of
	the global state that limited the use of this module to
	one stream per process. Files: global/smtp_stream.[hc].


	Bugfix: the SMTP server now flushes unwritten output before
	tarpit delays, to avoid protocol timeouts in pipelined
	sessions when a client causes lots of errors. Found by
	Lamont Jones, HP. File:  smtpd/smtpd_chat.c.

	Finished the LMTP client, which is based on a modified
	version of the SMTP client by Philippe Prindeville, Mirapoint,
	Inc., later modified by Amos Gouaux, UTDallas, and then
	Wietse ripped it all up again. Currently this talks LMTP
	over TCP only.

	Feature: override main.cf parameters in master.cf. Specify
	"-o parameter=value" after the program name. This allows
	you to selectively override myhostname etc. See also the
	new smtp_bind_address parameter below.


	Convenience: the LMTP and SMTP clients now append the local
	domain to unqualified nexthop destinations. This makes it
	more convenient to set up transport maps. Files:
	lmtp/lmtp_addr.c, smtp/smtp_addr.c.

	Sendmail compatibility: the Postfix SMTP client now skips
	servers that greet the client with a 4xx or 5xx status
	code.  To disable, set both smtp_skip_4xx_greeting and
	smtp_skip_5xx_greeting to "no".


	Portability: NetBSD has migrated to /etc/mail/aliases. We
	can expect to see this happen more often when systems start
	shipping Sendmail 8.10. File: util/sys_defs.h

	Updated LDAP code by John Hensley, with support for
	dereferencing of LDAP aliases, which have nothing to do
	with Postfix aliases.

	Feature: "smtp_bind_address=x.x.x.x" specifies the source
	IP address for SMTP client connections. Specify in master.cf
	as "smtp -o smtp_bind_address=x.x.x.x" in order to give
	different delivery agents different source addresses.


	Cleanup: mailbox_transport did not work with the lmtp
	delivery agent. This dates back to when Postfix used empty
	nexthop information to indicate that a destination was
	local. File: global/deliver_pass.c.

	Bugfix: configuration parameters for one mysql dictionary
	would become default settings for the next one. File:
	dict_mysql.c. This patch was merged into Postfix a while
	back but apparently that Postfix version was nuked when
	other parts were redesigned. Update by Scott Cotton.

	Bugfix: some Postfix delivery agents would abort on addresses
	of the form `stuff@.' which could be generated only locally.
	Found by Patrik Rak. File:  trivial-rewrite/resolve.c.

	Third-party Berkeley DB support for HP-UX by Lamont Jones.
	File: makedefs.


	Bugfix: Postfix would incorrectly reject domain names with
	adjacent - characters. File: util/valid_hostname.c.

	Bugfix: the 20000505 pipeline tarpit delay flush was wrong
	and caused the client and server to get out of phase. Yuck!


	Feature: VSTREAMs now have the concept of last fill/flush
	time, which is needed to prevent timeouts with pipelined
	SMTP sessions as detailed in the next item.

	Bugfix: delayed SMTP command/reply flushing to prevent
	sender delays from accumulating too much and causing timeouts
	with pipelined sessions.  For example, client-side delays
	happen when a client does DNS lookups to replace hostname
	aliases in MAIL FROM or RCPT TO commands; server-side delays
	happen when an UCE restriction involves a time-consuming
	DNS lookup, or when a server generates tarpit delays.
	Files:  lmtp/lmtp_proto.c, smtp/smtp_proto.c, smtpd/smtpd_chat.c.

	Portability: define ANAL_CAST for compilation environments
	that reject explicit casts between pointers and integral
	types. File: util/sys_defs.h, master/*server.c.  Upon closer
	investigation, this turned out to be the result of someone's
	compiler configuration preferences.  Therefore the change
	is likely to go away after a code cleanup.


	Feature: mysql client support for multi-valued queries
	(select email, email2 from aliastbl where username='$local')
	By Loic Le Loarer @ m4x.org. File: util/dict_mysql.c.

	Finalized the delayed SMTP command/reply flushing code in
	the SMTP and LMTP clients after lots of testing and review.


	Robustness: upon receipt of mail, map the mailer-daemon
	sender address back into the magic null string. File:


	Bugfix: the code for masquerade_exceptions was case sensitive.
	Reported by Eduard Vopicka.  File: cleanup/cleanup_masquerade.c.


	Feature: experimental queue manager by Patrik Rak with a
	fancy pre-emptive scheduling algorithm that improves delivery
	performance of mail with few recipients. This queue manager
	is made available as "nqmgr".


	Feature: the SMTP client SASL password file can contain
	entries for destination domain names (the address remote
	part) not just mail server hostnames. File: smtp_sasl_glue.c.

	Feature: smtpd_sasl_local_domain parameter (default:
	$myhostname) to specify the local SASL authentication realm.
	File: smtpd_sasl_glue.c.

	Feature: specify "body_checks=regexp:/file/name" for a very
	crude one line at a time message body content filter.  This
	feature uses the same filtering syntax as the header_checks
	feature.  File:  cleanup/cleanup_message.c. See also the
	conf/sample-filter.cf file.


	Feature: full content filtering through external software.
	This uses existing interfaces for sending mail to the
	external content filter and for injecting it back into
	Postfix.  Details in FILTER_README.  Files: pickup/pickup.c,
	smtpd/smtpd.c, qmgr/qmgr_message.c.


	More SASL feedback by Liviu Daia, regarding the use of
	authentication realms. File smtpd/smtpd_sasl_glue.c.

	Added a simple shell-script based content filtering example
	to the FILTER_README file.

	Content filtering support for nqmgr by Patrik Rak.  File:

	Renamed "content inspection" etc. to "content filtering"
	in anticipation of a new hook for content inspection that
	only inspects mail without re-injecting it into Postfix.


	Feature: limit the size of pipe mailer deliveries with the
	size=nnn command-line attribute. Patch by Andrew McNamara.


	Bugfix: don't try to do SASL authentication when running
	in stand-alone (sendmail -bs) mode. Fix by Liviu Daia.

	Bug: the unauthorized pipelining test fails with single
	recipient mail when smtpd_delay_reject = yes.


	Bugfix: conf/sample-ldap.cf was no longer up to date with
	reality. Patch by Lamont Jones, HP.

	Bugfix: the maildir delivery routine left temporary files
	lying around after unsuccessful delivery (problem reported
	by Brian Laughton @ Corp.Axxent.Ca).


	AIX 4.x had POSIX regular expression support all the time
	I was working on Postfix. Better find out late than never.


	Bugfix: the SMTP server did not reset the so-called junk
	command counter after successful delivery (Mark Hoffman @
	wallst.com).  File: smtpd/smtpd.c.


	Cleanup: remove Content-Length from incoming mail. The
	sender has no authority over the format of mail as stored
	by the receiving system. File: global/header_opts.h.

	Feature: rewrite Mail-Followup-To: as sender. Files:

	Cleanup: rewrite Reply-To, Errors-To, Return-Receipt-To as
	sender, so that address masquerading works as expected.
	Files: global/header_opts.c.

	Feature: specify "require_home_directory = yes" to prevent
	mail from being delivered to a user whose home directory
	is not mounted. File: local/dotforward.c.

	Cleanup: the pipe deliver agent no longer appends a blank
	line when the F flag (prepend From_ line) is specified.
	Specify the B flag if you need that blank line. The local
	delivery agent no longer appends a blank line to mail that
	is delivered to external command. Files:  pipe/pipe.c,


	Portability: support for NEXT/OPENSTEP requires extra
	include file in util/watchdog.c (Masaki Murase).


	Added macros to turn on vstream/vstring/etc. format string
	checking by gcc, in addition to the checking that was
	already implemented with printfck.  File: util/sys_defs.h,
	the macros for PRINTFLIKE and SCANFLIKE. Problem - unlike
	the printfck tool, gcc finds format argument type mismatches
	only in code that isn't #ifdef-ed out.


	Robustness: make_dirs() now continues when a missing
	directory is created by another process.


	Feature: the queue manager now logs the number of recipients
	when opening a queue file (a zero recipient count is logged
	with older queue files). File: global/opened.c.


	Robustness: added watchdog_pat() routine to keep the watchdog
	quiet if a client stays connected for a lot of time. Files:
	util/watchdog.[hc], smtpd/smtpd.c.


	Robustness: if relayhost is specified but the host does
	not exist, defer mail instead of bouncing it (which would
	lose the mail if the bounce would have to be delivered to
	that same non-existent relayhost). Problem reported by
	Chris Cooper @ maths.ox.ac.uk. File: smtp/smtp_connect.c.


	Feature: added -r (replace key+value) option to postalias
	and postmap.

	Cleanup: smtpd now replies with 555 when the client sends
	unrecognized RCPT TO parameters, as required by RFC 1869
	(problem report by Robert Norris @ its.monash.edu.au).
	File: smtpd/smtpd.c.


	Logging: the SMTP server's SASL code logs the authentication
	method along with an authentication failure. Suggested by
	Ronald F. Guilmette @ monkeys.com.

	Workaround: some systems have file size resource limits
	that cannot be represented with the off_t type that is used
	by standard functions such as lseek(2). Problem reported
	by Blaz Zupan @ amis.net.


	Feature: all this discussion about when to reject mail and
	when not made me decide to implement a TCP-based map type
	so that it becomes relatively simple to implement dynamic
	access controls, for example, hold off mail from an unknown
	client or sender until we have completed some investigation,
	after which we will either reject or accept.

	However, this code is turned off until it is finished.


	Robustness: the dns client now rejects malformed domain
	names rather than depending on the DNS to report that the
	name does not exist. Linux returns a rather misleading
	server failure code as found out by Patrik Rak. File:


	Feature: added IGNORE keyword to header_checks and body_checks
	to pretend that certain data does not exist. File:


	Bugfix: the SASL code did not allow MAIL FROM... AUTH=sender
	without prior authentication. The RFC allows this, although
	one wonders what the reasoning behind this is. File:


	Bugfix: the rmail script did not handle remote UUCP systems
	that send a from_ line with unqualified envelope sender.
	Reported by Luciano Mannucci.

	Compatibility: don't insert Sender: header lines. Sendmail
	has not done so for at least 10 years, if it ever did.
	Problem reported by Brad Knowles. File: cleanup/cleanup_message.c.


	Bugfix: when propagating an address extension in a virtual
	or canonical mapping, cleanup accesses memory that is no
	longer allocated. This can happen when the result address
	length is more than 100 characters.  Problem reported by
	Adi Prasaja @ satunet.com. File: global/mail_addr_crunch.c.

	Bugfix: fixed a misleading error message when the cleanup
	server reaches the queue file size limit. Fix by Robby
	Griffin @ MIT.EDU.  File: cleanup/cleanup_extracted.c.


	Bugfix: postalias -i would complain about duplicate entries
	for the Sendmail-compatible @ entry and for the NIS-compatible


	Gross hack: prevent looping on a bad recipient by always
	forwarding recipients in :include: files to a new mail
	delivery request, even when owner-listname is not set.
	File: local/recipient.c.


	Convenience: INSTALL.sh now imports default settings from
	the process environment, in order to make scripting easier.

	Robustness: INSTALL.sh now systematically skips over CVS,
	RCS and SCCS cruft.

	Portability: another fix for NEXTSTEP (Masaki MURASE).
	File: util/spawn_command.h.


	Cleanup: in a transport table entry, do not ignore port
	numbers specified as [host]:port. In fact, this is now
	becoming the preferred form, in order to avoid parsing
	problems with IPV6 addresses. Postfix supports both forms,
	but future versions will print a warning for the old form.
	Problem reported by Claus Fischer @ werhats.at

	Bugfix: missing initialization for state->sasl_method can
	cause permit_sasl_authenticated to always succeed.  Report
	and fix by Lutz Jaenicke @ aet.TU-Cottbus.DE.

	FAQ: added notes about how to delete, copy or restore queue
	files in a safe manner.


	File reorganization. No code change except Makefiles. All
	sources are pushed down by one directory level to keep file
	listings usable. Released as 20000922, so that I have a
	reference to run "diff -cr against.

	Bugfix: the spawn service was installed without man pages.

	Portability: MacOSX hints and tips by Joe Block, University
	of Central Florida School of Optics/CREOL

	Portability: The MacOSX gcc compiler does not understand
	the new printf_like/scanf_like attributes. File: util/sys_defs.h.


	nqmgr update from Patrik Rak for the changed queue manager
	to delivery agent protocol.

	Lame feature: syslog_facility parameter to control where
	syslogd sends Postfix logging (default: syslog_facility =
	mail).  However, errors during command-line parsing are
	still logged with the default syslog facility, as are errors
	while processing the main.cf file (surprise).  Based on
	code by Andrew McNamara.


	Cleanup: new bounce logfile API so that Postfix can change
	to an extensible bounce logfile format with per-recipient
	sender addresses (needed for VERP and for reporting local
	list delivery problems to the list owner) and other
	attributes.  File:  global/bounce_log.[hc].

	Cleanup: replaced the ad-hoc logfile parsing code in showq
	by something that uses the generic bounce logfile API.


	Feature: Postfix bounced mail and delayed mail notifications
	now have the standard RFC 1894 form (DSN). The bounce
	service now uses the generic bounce logfile API.  File:
	bounce/bounce_notify_service.c, bounce/bounce_notify_util.c.

	Cleanup: deleted the per-recipient bounce protocol.  Future
	bounce logfiles will support per-recipient bounce addresses.
	Files:  global/bounce.c, bounce/bounce_recip_service.


	Workaround: sendmail allows MAIL FROM and RCPT TO envelope
	addresses like <the dude <dude@site>> so we will never get
	rid of them. To disallow, specify "strict_rfc821_envelopes
	= yes".  File: smtpd/smtpd.c.


	Feature: a "flush" server that keeps per-destination records
	of deferred mail. It is the basis of a faster ETRN and
	"sendmail -qRsite" implementation. This code was rewritten
	half a dozen times.


	Bugfix: the stricter dns_lookup() argument checks revealed
	that Postfix was doing DNS lookups for domain literals
	([ip.address]) when expanding aliases in MAIL FROM and RCPT
	TO address parameters.  Reported by Jim Littlefield. File:

	Documentation: added text on the biff=yes/no parameter to
	conf/sample-local.cf (text provided by Paul Wagland,

	Robustness? Log errors from SASL library code as warnings
	not as fatal errors. Files: smtp*/*glue.c.


	Feature: in master.cf, specify ? after wakeup time to avoid
	waking up services that aren't being used.


	Feature: the fast flush refresh and purge time interval
	parameters can now be specified in user-specified units by
	providing an appropriate suffix:  s (seconds), m (minutes),
	h (hours), d (days), w (weeks).  unit.  This was needed so
	that I could test the flush server code in a reasonable
	way (its timeouts are normally specified in days or hours,
	and I don't have that much time for testing).  Other Postfix
	time interval parameters will be migrated as time permits.
	Files:  conf/sample-flush.cf, global/mail_conf_time.c,

	Unfeature: qmgr_hog_factor is now disabled by default. It
	was just too confusing. If you don't know what this means,
	do not worry.


	Cleanup: after "postfix reload" do not penalize mail that
	was in the active queue, but make it ready for immediate
	delivery so that ETRN etc. works as intended. Files:
	*qmgr/qmgr.c, *qmgr/qmgr_active.c.

	Portability: Redhat 7 library interfaces have changed
	incompatibly, which breaks existing software. File makedefs.

	Consistency: the fallback_relay parameter did not understand
	the [] or host:port syntax, and there was no way to suppress
	MX record lookups. Files: smtp/smtp_addr.c, smtp/smtp_connect.c.

	Convenience: you can now specify multiple SMTP destinations
	in the relayhost or fallback_relay configuration parameters.
	The specified destinations will be tried in the specified
	order. File:  smtp/smtp_connect.c.

	Many typographical corrections by Matthias Andree.


	Documentation: the canonical, virtual etc. manual pages
	did not document the effect of leading whitespace.


	Bugfix: virtual map expansion stopped too early with
	self-referential aliases. Reported by Michael Douglass @
	datafoundry.net. File: cleanup/cleanup_map1n.c.


	Horror:  postmap and postalias (newaliases) silently lose
	the file lock while building a lookup table with Berkeley
	DB 2.x and later on Solaris, HP-UX, IRIX, and UNIXWARE.
	The result is that table lookups fail while the table is
	being built, so that mail is lost.  In order to avoid this
	misbehavior one has to use an undocumented feature that is
	NOT available with the DB1.85 compatibility interface.
	Therefore, Postfix now supports three Berkeley DB programming
	interfaces of increasing complexity. File: util/dict_db.c.

	Bugfix: some character manipulations were not portable for
	signed/unsigned characters. Files: global/quote_821_local.c,

	Workaround: apparently, some software sends SMTP mail that
	begins with "From sender time-stamp". Sendmail silently
	ignores such RFC violating garbage, and therefore Postfix
	needs to jump another hoop.  File: smtpd/smtpd.c.


	Bugfix: the flush server tried to access config files after
	going to the chroot jail. Found by Lutz Jaenicke, TU-Cottbus.DE.
	File: flush/flush.c.

	Update: revised LDAP module from primary maintainer John
	Hensley, with contributions from many other people. Files:
	util/dict_ldap.c, LDAP_README.

	Update: LINUX2 chroot setup script by Matthias Andree,

	Feature: specify unix:/path/name for LMTP connections over
	UNIX-domain sockets, and specify inet:host or inet:host:port
	for IPV4. If no unix: or inet: is specified, IPV4 is assumed.
	File: lmtp/lmtp_connect.c.

	Feature: added UNIX-domain support to the smtpstone test
	programs in order to test the LMTP client UNIX-domain


	Bugfix: further testing in preparation for 19991231-pl10
	revealed that the DB map code was now broken for every


	Performance: the slow start (gradually increase number of
	parallel connections to the same site) was too gentle and
	Postfix would back off too quickly. Files: qmgr/qmgr_queue.c
	and nqmgr/qmgr_queue.c.


	FAQ update by Ralph Hildebrandt.


	Portability: RedHat Linux has changed incompatibly, again.
	Fixed with the help of Matthias Andree.  File: makedefs.


	Cleanup: changed prototype of internal function that did
	not return a useful result. File: src/util/vstream_popen.c.


	Workaround: the Debian post install script passes an open
	file descriptor into the master server and waits forever.
	Reported by Lamont Jones. File: master/master.c.


	Compatibility: added sendmail -G (gateway submission) option
	for compatibility with the sendmail rmail command. Requested
	by David Gilbert, Velocet Communications.


	Documentation: added MAILER-DAEMON to the list of sample
	masquerade_exceptions settings in conf/sample-rewrite.cf.
	Suggested by Karl O. Pinc, pop.artic.edu.

	Performance: the slow start (gradually increase number of
	parallel connections to the same site) was too gentle and
	Postfix would back off too quickly. Files: qmgr/qmgr_queue.c
	and nqmgr/qmgr_queue.c. Yup, changed the same code, again.
	We now allow for a margin above the actual concurrency,
	with the size of the initial destination concurrency.
	Final solution by Patrik Rak.

	Bugfix: the recipient home directory test broke mailbox_transport
	support for non-UNIX recipients.  File:  local/recipient.c.


	Robustness: additional integrity tests for the nqmgr by
	Patrik Rak. File: nqmgr/qmgr_message.c.


	Bugfix: the new LDAP client code did not work properly if
	the new ldap_domain parameter was not specified. LaMont
	Jones, HP.  File: util/dict_ldap.c.

	Feature: the soft_bounce safety net is extended to the SMTP
	server. With "soft_bounce = yes", The SMTP server changes
	all 5xx (reject) replies into 4xx (try again) replies.

	Documentation: the virtual(5) man page now documents both
	Postfix-style virtual domains and Sendmail-style virtual
	domains, including their interaction with local usernames,
	aliases and mailing lists. Hopefully, this ends some of
	the confusion surrounding virtual domain support. Updated
	several FAQ entries concerning virtual domain support.

	Documentation: added FAQ entry for the biff service.


	Bugfix: per-destination queue names were case sensitive so
	that the same site could have multiple queues.  Reported
	by Patrik Rak. Files: *qmgr/qmgr_message.c.


	Bugfix: per-destination deferred mail logfiles were case
	sensitive so that the same site could have multiple deferred
	mail logfiles, so that not all mail would be flushed with
	ETRN. Reported by Ralph Hildebrandt. Files:  flush/flush.c.

	Portability: added (int) casts to printf-like arguments
	that specify the width of %*letter conversions.  On some
	systems, sizeof and pointer difference expressions are
	wider than an int.  Reported by Valentin Nechayev @ lucky.net.


	Compatibility: Postfix now retries delivery when an external
	command is killed by a signal, because people expect such
	behavior from Sendmail. File: global/pipe_command.c.


	Feature: mailbox locking is now configurable. The configuration
	parameter name is "mailbox_delivery_lock". Depending on
	the operating system one can specify one or more of "flock",
	"fcntl" and "dotlock". Use "postconf -l" to find out what
	locking methods Postfix supports. The default setting is
	system dependent.  All mailbox file opens are now done by
	one central mbox_open() routine. This affects the operation
	of the postlock command, and of local delivery to mailbox
	or /file/name.  Files: util/safe_open.c, util/myflock.c,
	global/deliver_flock.c, global/mbox_conf.c, global/mbox_open.c.
	local/mailbox.c, local/file.c, postlock/postlock.c.

	Compatibility: the old sun_mailtool_compatibility parameter
	is being phased out. It still works (by turning off
	flock/fcntl locks), but logs a warning as a reminder that
	it will go away.

	Compatibility: when delivering to /file/name, the local
	delivery agent now logs a warning when it is unable to
	create a /file/name.lock file, and then delivers the mail
	(older Postfix versions would silently deliver).


	Feature: specify "smtp_never_send_ehlo = no" to disable
	ESMTP.  Someone asked for this long ago. Files:  smtp/smtp.c,

	Feature? Bugfix? The smtp client now skips server replies
	that do not start with "CODE SPACE" or with "CODE HYPHEN",
	and flags them as protocol errors. Older versions silently
	treat "CODE TEXT" as "CODE SPACE TEXT".  File:  smtp/smtp_chat.c.


	Documentation: postmap(1) and postalias(1) did not document
	the process exit status for "-q key".


	Bugfix: the Postfix master daemon no longer imported
	MAIL_CONF and some other necessary environment parameters.
	Postfix now has explicit "import_environment" and
	"export_environment" configuration parameters that control
	what environment parameters are shared with non-Postfix
	processes. Files: util/clean_env.c, util/spawn_command.c,
	util/vstream_popen.c, global/pipe_command.c, and everything
	that invokes this code.


	Bugfix: while processing massive amounts of one-recipient
	mail, qmgr could deadlock for 10 seconds while sending a
	bounce message. All queue manager bounce send requests are
	now implemented asynchronously.  Files: global/abounce.[hc]
	(asynchronous bounce client), qmgr/qmgr_active.c.  Problem
	reported by El Bunzo (webpower.nl) and Tiger Technologies


	Feature: mailbox_transport and fallback_transport can now
	have the form transport:nexthop, with suitable defaults
	when either transport or nexthop are omitted, just like in
	the Postfix transport map. This allows you to specify for
	example, "mailbox_transport = lmtp:unix:/file/name". File:


	Bugfix: the local_destination_concurrency_limit paramater
	no longer worked as per-user concurrency limit but instead
	worked as per-domain limit, so that the limit of "2" in
	the default main.cf files resulted in poor local delivery
	performance.  Files:  qmgr/qmgr_message.c, qmgr/qmgr_deliver.c.
	Problem reported by David Schweikert (ee.ethz.ch) and Dallas
	Wisehaupt (cynicism.com).


	Feature: support for MYSQL connections over UNIX-domain
	sockets by Piotr Klaban.  Files: util/dict_mysql.c,


	Small dirt: postconf -m produced too much output due to a
	missing "else", and the optional SASL code needed a fix
	for the changed name_mask API.


	Workaround: due to an error, record type L for "filter
	transport name" was the same as that for the already existing
	record type L for "record not ending in newline", causing
	the pickup daemon to discard all records not ending in
	newline. The code cannot be changed without breaking
	compatibility with queued mail, so the pickup server is
	changed to discard type L records only from the message
	envelope, not from the content. File: pickup/pickup.c.


	Bugfix: dict_ldap did not properly initialize a handle
	after connection timeout. Problem reported by Alain Thivillon.
	File: util/dict_ldap.c.


	Feature: local_transport and default_transport now also
	understand the transport[:destination] notation, so that
	all transport config parameters are similar again. File:
	trivial-rewrite/resolve.c, trivial-rewrite/transport.c.

	Code cleanup: mailbox_transport and fallback_transport no
	longer allow the user to omit the transport part of a
	transport:destination specification. That just did not make
	any sense at all. The :destination part is still optional.
	File: global/deliver_pass.c.

	Feature: most time-related configuration parameters take
	a one-letter suffix that specifies the time unit:  s
	(second), m (minutes), h (hours), d (days), w (weeks).
	"postconf -d" output includes the default time unit. Files:

	Code cleanup: in a CONFIG_TIME_TABLE, the default time unit
	is now always the last character of a default time value.
	It is no longer necessary to specify the default time unit
	separately. This change means that it will not be possible
	to specify default values in the form of function calls,
	but that was unused anyway.  Files: global/mail_conf_time.c,
	and user code.


	Bugfix: reorganized some code in the MYSQL client to end
	a number of memory allocation/deallocation problems.  This
	code needs more work. File: dict_mysql.c.


	Bugfix: the MYSQL client did not provide function pointers
	for unimplemented operations, causing "postmap -d" to dump
	core instead if issuing an error message. This is what I
	get for accepting code that I cannot test myself.


	Code cleanup: configuration parameters that are $name
	expanded at run-time now have their own data type hierarchy
	instead of being piggy-backed on top of strings that are
	$name expanded at program initialization time.  Files:
	global/mail_conf.h, global/mail_conf_raw.c, and code that
	calls it.


	Update: replaced the default rbl.maps.vix.com setting by
	the current blackholes.mail-abuse.org.


	Code cleanup: the queue manager is a bit greedier with
	allocating a delivery agent. Problem pointed out by Patrik
	Rak. All bugs in the solution are mine.  Files:


	Bugfix: the FILTER_README shell script example did not
	correctly pass exit status to the parent.

	Bugfix: soft errors in client hostname lookups would be
	treated as hard errors. Fix by Michael Herrmann
	(informatik.tu-muenchen.de). File: smtpd/smtpd_peer.c.


	Bugfix: the mkdir() EEXIST race condition workaround was
	not complete.  Matthias Andree, Daniel Roesen.  Files:
	global/mail_queue.c, util/make_dirs.c.


	Portability: IRIX 6.5.10 defines sa_len as a macro, causing
	a name collision with a variable used by Postfix. Roberto
	Totaro, enigma.ethz.ch. File:  smtpstone/smtp-source.c.


	Bugfix: REJECT by header/body_checks was flagged in smtpd
	as a bounce, should be policy, in order to make postmaster
	notifications more consistent. File: smtpd/smtpd.c.

	Merged updated chroot setup procedure by Matthias Andree.
	Files: examples/chroot-setup/LINUX2.


	Formatting: changed the seconds and days formats in the
	"your mail is delayed" text so that it does not switch to
	scientific notation. File: bounce/bounce_notify_util.c.


	Feature: SASL support for the LMTP client. Recent CYRUS
	software requires this for Postfix over TCP sockets.


	Bugfix: the 20001005 revised fallback_relay support caused
	Postfix to send mail to the fallback even when the local
	machine was an MX host for the final destination. Result:
	mailer loop. Found by Laurent Wacrenier (teaser.fr).  Files:
	smtp/smtp_connect.c, smtp/smtp_addr.c.


	Workaround: specify "broken_sasl_auth_clients = yes" in
	order to support old Microsoft clients that implement a
	non-standard version of RFC 2554 (AUTH command).

	Workaround: Lotus Domino 5.0.4 violates RFC 2554 and replies
	to EHLO with AUTH=LOGIN. File: smtp/smtp_proto.c.


	Code cleanup: wrote creator/destructor for dictionary
	objects that provides default methods that trap all attempts
	to perform an unimplemented operation. Based on an ansatz
	by Laurent Wacrenier (teaser.fr).  Files: util/dict*.[hc].

	Code cleanup: INSTALL.sh does not ask questions when stdin
	is not connected to a tty (as in: make install</dev/null).
	To automate a customized install, the script imports
	environment variables for install_root etc.


	Workaround: randomize the delay between attempts to lock
	a file, so that multiple bounce or defer servers are less
	likely to retry all at the same time.  likely.  File:
	util/rand_sleep.c, global/deliver_flock.c, global/dot_lockfile.c.


	Code cleanup: complaints about invalid or numeric hostnames
	either provide specific context or are removed as redundant.
	Files:  util/valid_hostname.c dns/dns_lookup.c.

	Code cleanup: new mailbox_size_limit parameter (default:
	20MB).  Until now, the mailbox size limit was the same as
	the message size limit, due to artefact of implementation.
	Files: global/mail_params.h, local/local.c.

	Bugfix: fix for the ldap_domains parameter, both semantics
	and documentation by LaMont Jones. Files:  LDAP_README,
	conf/sample-ldap.cf, util/dict_ldap.c.

	Update: merged in the virtual delivery agent by Andrew
	McNamara.  See VIRTUAL_README for detailed examples.

	Update: merged a re-vamped nqmgr by Patrik Rak.


	Tweak: several little nqmgr tweaks by Patrik Rak. Files:
	global/mail_params.h, nqmgr/qmgr_job.c.

	Bugfix: the virtual delivery agent did not save maps_find()
	results timely. J?rgen Thomsen, postfix.jth.net. File:

	Security: disallow regexp tables in the virtual delivery
	agent.  The $1 etc. substitution mechanism gives too much
	power to the sender. File: virtual/mailbox.c.

	Cleanup: clarified documentation and boundary cases in the
	random_sleep() routine.

	Bugfix: the MISSING_USLEEP feature was used backwards.
	Patrik Rak. File: util/random_sleep.c.


	Workaround: Linux usleep() is void, BSD/Solaris usleep()
	returns int, don't use it. File util/random_sleep.c.

	Made local maildir bounce/defer handling mode consistent
	with local mailbox delivery. File local/maildir.c.

	The smtp client now defers delivery when all MX hosts have
	no A record. File: smtp/smtp_addr.c

	Bundled the man2html and postlink quick hacks so people
	can do their own manual page processing. See scripts in
	the mantools directory.

	Documentation: updated the reference to sendmail in the
	html/index.html page.

	Documentation: added note about the Cisco PIX "fixup smtp"
	bug that causes mail delivery problems when "." and "CRLF"
	arrive in separate packets. File:  html/faq.html.


	Bugfix: another missing initialization in the mysql client.
	File: util/dict_mysql.c.

	Sanitized time routine by Patrik Rak, to make his nqmgr
	robust against people who set their clock back.  Files:

	Bumped the default mailbox file size limits to 50MB.


	Bugfix: fixed the way the master resets the file size limit
	to avoid problems when a Postfix daemon updates a queue
	file.  The file size limit is now increased to INT_MAX if
	it is smaller than INT_MAX, so that it is less likely to
	interfere than the old setting of message_size_limit.

	Feature: disable mailbox size limits for the local and
	virtual delivery agents by setting mailbox_size_limit or
	virtual_mailbox_limit to zero.


	Update: null candidate patch from Patrik Rak. Files:
	nqmgr/qmgr_entry.c nqmgr/qmgr_job.c nqmgr/qmgr_message.c.

	Cleanup: added one gruesome command to the postlink script
	for hyperlinking nroff manual page output. Word abbreviation
	broke some <a href...> </a> instances across line boundaries.
	sed(1) is an amazing tool.  File: mantools/postlink.


	Laid the ground work for logging of table accesses. This
	will give more insight into how Postfix uses its lookup
	tables. User interface comes later.  File:  util/dict_debug.c.


	Bugfix: the pipe delivery agent expanded $size as if it
	were a recipient, instead of expanding it as $nexthop or
	as $sender. Reported by Michael Tokarev. File: pipe/pipe.c.


	Bugfix: poor LMTP performance for domains that are listed
	in $mydestination, because Postfix would send one recipient
	at a time, with multiple deliveries of recipients of the
	same message in parallel; a similar problem could exist
	with virus scanning and with firewall relay hosts that
	forward mail for $mydestination to an inside machine. This
	behavior is now changed to depend on the transport-specific
	xxx_destination_recipient_limit parameter.  This also means
	that you can now get qmail behavior for SMTP deliveries by
	setting smtp_destination_recipient_limit=1.  File:

	Workaround: Solaris socketpair() can fail with EINTR. Added
	a sane_socketpair.c module that joins the ranks of the
	other sane_whatever workarounds. Reported by Andrew McNamara.
	File: util/sane_socketpair.[hc]


	Documentation: the default main.cf file has a prominent
	warning that mynetworks should be properly configured in
	order to reject unauthorized mail relay requests from

	Documentation: the INSTALL document, section "mandatory
	configuration file edits" has a section that explains that
	mynetworks should be properly configured in order to reject
	unauthorized mail relay requests from strangers.


	Documentation: the basic.html document has a section that
	explains that mynetworks should be properly configured in
	order to reject unauthorized mail relay requests from

	Feature: new "mynetworks_style" parameter that controls
	how mynetworks (trusted networks) is derived from the
	inet_interfaces (machine interfaces) setting. Specify
	"class" for entire class A, B, C networks; "subnet" for
	the local subnets only; or "host" for maximal privacy.
	Files:  util/inet_addr_local.[hc], global/own_inet_addr.[hc],
	global/mynetworks.[hc], postconf/postconf.c.

	Portability: MACOSX patches by Gerben Wierda.

	Portability: Solaris /dev/null is a symlink, which tripped
	up the code to safely open a file before local delivery.
	We now grudgingly allow symlinks owned by root. File:


	Bugfix: "postconf mynetworks" ignored the inet_interfaces
	setting. That was a very old one. File: postconf/postconf.c.

	Specify "mynetworks_style = class" to get the old behavior.


	Portability: master sigchld handler based on writing to a
	pipe, so that the master wakes up from select(). Based on
	code by Erik Forsberg, Linkoping University, Sweden.  File:
	master/master_sig.c. Disabled until after the major release.

	Code cleanup: Postfix should now run with no alias database.

	Code cleanup: local_destination_recipient_limit and
	local_destination_concurrency_limit have become first-class
	configuration parameters. Files: global/mail_params.h,
	*qmgr/qmgr.c, postconf/postconf.c.


	Documentation suggestions by Lars Hecking and Richard
	Huxton, Matthias Andree and many others.

	Code cleanup: some queue/transport operations need to be
	moved, after the code cleanup of the recipient/concurrency
	limit handling. Patrik Rak.  Files: *qmgr/qmgr_message.c.


	Feature: configurable name in syslog output (default:
	"syslog_name = postfix") so that different Postfix instances
	can be recognized by their logging. File: global/mail_task.c.


	Workaround for logic mismatch in nqmgr that was exposed
	with the introduction of the asynchronous bounce client.
	Patrik Rak.


	Bugfix: the RFC 822 untokenizer quoted newlines inside
	comments. File: global/tok822_parse.c.


	Cleanup: removed an extraneous warning when a queue file
	write error happened.


	Workaround: LMTP connection caching never worked for
	destinations starting with unix: or inet:. File:


	Portability: Solaris <2.6 does not have srandom() and
	random() in libc. File: util/rand_sleep.c. It does not have
	to be cryptographically strong.

	Bugfix: the fast ETRN flush server could not handle [ipaddr]
	or domain names with one-character hostname part.  This
	fix changes the destination to logfile name mapping, so
	that you need to populate the new files with "sendmail -q".
	The old files go away automatically. File:  flush/flush.c.


	Speed up mailq (sendmail -bp) display by flushing output
	after each file.  File: showq/showq.c.

	Portability: missing string.h includes, %p wants (void *),
	Lamont Jones, HP.


	Bugfix: swapped logic caused cleanup to stall when the
	queue file size exceeded the file size limit by less than
	one the VSTREAM buffer size, so that the "file too big"
	was detected after flushing the last queue file record.
	File: cleanup/cleanup.c.


	Portability: workaround for missing prototype problem in
	dict_ldap.c. This module should move to the global directory,
	because it depends on Postfix main.cf parameter information.

	Workaround: after sending a trigger message over a socket,
	do not immediately close the client side, but close it from
	a background thread that waits until the server closes the
	socket first. This avoids trouble with socket implementations
	that destroy a socket when the client closes a socket before
	the server has received the client's data.  Files:
	util/{inet,unix,stream}_trigger.c, util/events.c,
	master/master_trigger.c, postkick/postkick.c.


	Workaround: the mysql library can return null pointers
	rather than zero-length strings. File: util/dict_mysql.c.


	Ergonomics: log additional information about the reason
	why "mail for XXX loops back to myself" when the local
	machine is the best MX host. File: smtp/smtp_addr.c.


	Changed some noisy LDAP client warnings into optional
	logging. LaMont Jones, util/dict_ldap.c.


	Bugfix: the SMTP server now replies with 550 instead of
	503 when it receives the DATA command without having received
	a valid recipient address. This is needed for the Sendmail
	client-side pipelining implementation. Problem reported by
	Lutz Jaenicke. File: smtpd/smtpd.c.

	Cleanup: shut up if chattr fails on Reiserfs and other file
	systems that do not support the respective attributes.
	Files: conf/postfix-script-{no,}sgid.


	Ergonomics: Postfix applications now warn when a DB or DBM
	file is out of date, and recommend to rebuild the table.
	Files: util/dict_db.c, util/dict_dbm.c.


	Feature: specify a key of "-" to the postmap or postalias
	-q or -d option, and the keys will be read from standard
	input, one key per line. Files: postmap/postmap.c,

	Bugfix: with a non-default inet_interfaces setting, the
	master ignored host information in master.cf host:port
	settings.  Fix by Jun-ichiro itojun Hagino @ iijlab.net.
	Files: master/master.h, master/master_ent.c.


	Bugfix: the SMTP server did not parse invalid MAIL FROM or
	RCPT TO addresses such as <first last <user@domain>> the
	way it was supposed to do.  I thought this was taken care
	of years ago. File:  smtpd/smtpd.c.


	Bugfix: smtpd would reject mail instead of replying with
	a 4xx temporary error code when, for example, an LDAP or
	mysql server was unavailable. Remotely based on a fix by
	Robert Kiessling @ de.easynet.net. File: smtpd/smtpd_check.c.


	Feature: the Postfix SMTP client now by default randomly
	shuffles destination IP addresses of equal preference.
	Specify "smtp_randomize_addresses = no" to disable.
	Shuffling code by Elias Levy @ SecurityFocus.com Files:
	dns/dns_rr.c, smtp/smtp_addr.c.


	Bugfix: The SMTP server's 550 in reply to DATA should be
	a 554 response.  And it wasn't Sendmail. Claus Assman.

	Bugfix: the INSTALL.sh test for non-interactive upgrade
	broke rooted installations that specify settings via the
	environment.  Simon Mudd.

	Bugfix: mailq output is now really flushed one message at
	a time. File: sendmail/sendmail.c.

	Feature: "postsuper -d queueID" deletes one message queue
	file; "postsuper -d -" reads zero or more queue IDs from
	standard input, and deletes one instance of each file.
	File: postsuper/postsuper.c.

	Code cleanup: in order to make postsuper -d safe with a
	running Postfix mail system, some routines had to be made
	tolerant for sudden queue file disappearances.  Files:
	global/deliver_request.c, *qmgr/qmgr_move.c.

	Code cleanup: in order to make postsuper -d more usable,
	the showq command was extended to safely list the possibly
	world-writable maildrop directory.  File:  showq/showq.c.


	Feature: postsuper -d will also delete defer and bounce
	logfiles when the named queue file is found.


	RFC 2821 feature: an SMTP server must reset all buffers
	upon receipt of EHLO. File:  smtpd/smtpd_check.c.

	RFC 2821 feature: an SMTP server must accept a recipient
	address of "postmaster" without domain name. File:

	RFC 2821 recommendation: reply with 503 to commands sent
	after 554 greeting. File:  smtpd/smtpd.c.

	RFC 2821 recommendation: if VRFY is enabled, list it in
	the EHLO response. File:  smtpd/smtpd.c.

	RFC 2821 recommendation: SMTP clients should use EHLO.
	The default setting of smtp_always_send_ehlo has changed
	from 0 (send EHLO if server greets with ESMTP) to 1 (always
	send EHLO). In all cases, Postfix falls back to HELO if
	the server does not support EHLO. File: smtp/smtp_proto.c.


	Bugfix: with soft_bounce=yes, the SMTP server would log
	5xx replies even though it would send 4xx replies to the
	client (Phil Howard, ipal.net). File: smtpd/smtpd_check.c.


	Compatibility: Microsoft sends "AUTH=MBS_BASIC LOGIN".
	Updated the parsing code in smtp/smtp_proto.c.  Problem
	reported by Ralf Tessmann, Godot GmbH.


	Standard: deleted the non-standard "via" portion from
	Received: headers generated by Postfix bounce or other
	notification processes.  File: global/post_mail.c.

	Robustness: eliminated stack-based recursion from the RFC
	822 address parser. File: global/tok822_parse.c.

	Standard: annotated the source code with comments based on
	RFC 2821 and 2822. Not all the RFC changes make sense.

	RFC 2821 recommendation: treat a RCPT 552 reply as if the
	server sent 452. Files: smtp/smtp_proto.c, lmtp/lmtp_proto.c.

	Cleanup: moved ownership of the debug_peer parameters from
	the applications to the library, so that a Postfix shared
	library does not suffer from undefined references.  Files:
	smtp/smtp.c, lmtp/lmtp.c, smtpd/smtpd.c, global/mail_params.c.
	LaMont Jones, for Debian.


	Feature: "postsuper -r queueID" re-queues a message, and
	"postsuper -r ALL" re-queues all mail. The message is moved
	to the maildrop queue so that the pickup daemon will copy
	it to a new queue file, and so that address rewriting will
	be done again. This is useful after changes of address
	rewriting or virtual mappings.

	Feature: "postsuper -d ALL [queue-name]" deletes a bunch
	of mail.


	Feature: "postsuper -s" (which is done by default) renames
	queue files whose name (queue ID) does not match the message
	file inode number.

	Bugfix: memory leak in the LDAP client module. Alain
	Thivillon, France Teaser - Groupe Firstream.


	Portability: gcc 2.6.3 does not have __attribute__ (Clive
	Jones, dgw.co.uk). File: util/sys_defs.h.

	Bugfix: the SMTP and LMTP clients claimed that a queue file
	needed to be delivered again (even when all recipients were
	erased from the queue file) when no QUIT or RSET reply was
	received (by default, this does not happen with SMTP mail
	because the SMTP client does not wait for QUIT replies and
	does not send RSET to deliver mail).  As a result of the
	same bug the LMTP client followed a dangling pointer when
	sending QUIT after process idle timeout while the LMTP
	server had disconnected.  Files:  smtp/smtp_proto.c,


	newaliases no longer complains when an empty list is
	specified with the alias_database configuration parameter.
	File:  sendmail/sendmail.c.


	Workaround: old PIX firewall code messes up when the final
	".<CR><LF>" at the end of DATA spans a packet boundary.
	When Postfix detects PIX SMTP fixup mode, Postfix flushes
	the output buffers before sending the final ".<CR><LF>".
	File:  smtp/smtp_proto.c.


	Portability: updated code for Mac OS X, accounting for the
	post-Beta changes. Code by Joe Block, UCF School of


	Safety: postdrop turns off interrupts when cleaning up
	after interrupt. The additional safety does not hurt anyone.
	File: src/postdrop/postdrop.c.


	Safety: dropped the RFC 2821 compliant code that treats
	552 RCPT TO replies as 452. It created more problems than
	it solved. Files: smtp/smtp_proto.c, lmtp/lmtp_proto.c.

	Logging: the SMTP server now logs a warning if RBL lookups
	have problems other than "not found". file: smtpd/smtpd_check.c.


	Feature: address quoting and case folding flags for the
	pipe(8) mailer.


	Workaround: some MTAs fall on their face when they receive
	unexpectedly long lines. From now on, Postfix defaults to
	breaking long lines at 2048 (like Sendmail so it has got
	to be right). To get the old, content preserving, behavior
	specify "smtp_truncate_lines = no". File: smtp/smtp_proto.c.


	Bugfix: did not really undo 2821 552->452 mapping.


	Bugfix: postfix-script used a hard-coded maildrop group
	owner instead of using the install-time specified name
	stored in /etc/postfix/install.cf. Problem reported by
	David Terrell @ meat.net.


	Feature: mail_spool_directory ending in / causes maildir
	style delivery.

	Bugfix: the FreeBSD kernel parameters kern.ipc.nmbclusters
	and kern.ipc.maxsockets cannot be set with sysctl commands.
	File: html/faq.html. Len Conrad @ Go2France.com.

	Cleanup: the virtual delivery agent was poorly integrated
	so that the SMTP server and queue manager did not reject
	mail for unknown users. Files: smtpd/smtpd_check.c.


	Feature: QMQP server, compatible with qmail and the ezmlm
	list manager.  Files:  util/netstring.[hc], qmqpd/qmqpd*.c.


	Feature: QMQP stress test message generator program.  Files:
	smtpstone/qmqp-source.c, smtpstone/qmqp-sink.c.


	Bugfix: with disable_dns=yes, the SMTP client treated all
	host lookup errors as permanent. File: smtp/smtp_addr.c.


	Feature: VERP support, based on a patch by Peng Yong, and
	with the missing parts filled in so that the Postfix bounce
	daemon can send one VERP bounce per undeliverable recipient.
	Files: , sendmail/sendmail.c, smtpd/smtpd.c, qmgr/qmgr_deliver.c,
	bounce/bounce_notify_verp.c, qmqpd/qmqpd.c, plus a couple
	support routines in the global library.

	Cleanup: with recipient_delimiter=+ (or any character other
	than -) Postfix will now recognize address extensions even
	with owner-foo+extension addresses. This is necessary to
	make VERP work for mailing lists.


	Bugfix: potential memory leak in the queue managers with
	the new VERP delimiter record. Fix by Patrik Rak.


	Cleanup: you can now specify the VERP delimiter characters
	on the sendmail(1) command line, but they are still optional.

	Safety: with maildir style delivery and with hashed mailboxes
	the system mail spool directory must not be world writable.


	Safety: the verp_delimiter_filter parameter (default: -=+)
	limits what characters Postfix accepts as VERP delimiter


	Logging: the queue manager now logs a "status=expired"
	record when it returns a message that is too old.  Files:


	Feature: stiffer coupling between mail receiving rates and
	mail delivery rates, using a trivial token-based scheme,
	implemented by reading and writing an in-memory pipe.  The
	queue manager produces one token when it retrieves mail
	from the incoming queue. The cleanup daemon consumes one
	token when it adds mail to the incoming queue. If no token
	is available the cleanup server pauses for $in_flow_delay
	seconds and proceeds anyway. The delay allows mail sending
	process to catch up and access the disk while not blocking
	inbound mail. Valid delays are 0..10 seconds.


	Bugfix: updated LDAP client module from LaMont Jones, HP.
	This also introduces new LDAP query filter patterns: %u
	(address localpart) and %d (domain part). Files:
	conf/sample-ldap.cf, util/dict_ldap.c.


	Bugfix: recursive smtpd_whatever_restrictions clobbered
	intermediate results when switching between sender and
	recipient address restrictions. Problem found by Victor
	Duchovni, morganstanley.com. In order to fix, introduced
	address resolver result caching, which should also help to
	speed up sender/recipient address restriction processing.

	Bugfix: the not yet announced DUNNO access table lookup
	result did not prevent lookups with substrings of the same
	lookup key. Found by Victor Duchovni, morganstanley.com.


	Robustness: trim trailing whitespace from regexp and pcre
	right-hand sides, for consistency with DB/DBM tables.
	Files: util/dict_pcre.c, util/dict_regexp.c.


	Robustness: eliminate duplicate IP addresses after expansion
	of hostnames in $inet_interfaces, so that Postfix does not
	suddenly refuse to start up after someone changes the DNS.
	Files:  util/inet_addr_list.c global/own_inet_addr.c.

	Feature: specify "disable_verp_bounces = yes" to have
	Postfix send one RFC-standard, non-VERP, bounce report for
	multi-recipient mail, even when VERP style delivery was


	Bugfix: postconf was using unexpanded values internally
	for myhostname, inet_interfaces, and mynetworks_style.
	This broke the "postconf -d" mynetworks computation.  File:


	Feature: masquerade_classes parameter for fine control of
	address masquerading. The default setting is backwards
	compatible: envelope_sender header_sender header_recipient.
	Files: cleanup/whatever.c.


	Code cleanup: the bounce daemon complained about data that
	it was not going to send back anyway. Fix: stop reading
	the original message when the bounce message reaches the
	bounce message size limit. File: bounce/bounce_notify_util.c.


	Logging: postsuper now logs the queue ID when it requeues
	a message, or when it deletes a message from the mail queue.
	File: postsuper/postsuper.c.


	Safety: the SMTP server now sends a 4xx (try again later)
	response when an UCE restriction is misconfigured, instead
	of ignoring the bad restriction and possibly accepting mail
	that it should not accept.   File: smtpd/smtpd_check.c.


	Workaround: the Postfix qmqp-source program produced mail
	not ending in newline. qmail-qmqpd accepts such mail, but
	qmail-remote is unable to deliver it.  Matthias Andree,
	uni-dortmund.de. File: smtpstone/qmqp-source.c.


	Bugfix: the smtp-sink stress test program broke when RCPT
	TO commands crossed network packet boundaries. Problem
	reported by Matthias Andree, uni-dortmund.de.  File:


	Code cleanup: permit_mx_backup implements the old behavior
	(accept mail if the local MTA is MX relay), and allows an
	additional restriction via the permit_mx_backup_networks
	parameter (accept mail only if the primary MX hosts match
	the specified list of network blocks). This second restriction
	is now entirely optional, for backwards compatibility.

	Bugfix: an address extension could be appended multiple
	times to the result of a canonical or virtual map lookup.
	File: global/mail_addr_map.c.  Fix by Victor Duchovni,
	Morgan Stanley.

	Bugfix: split_addr() would split an address even when there
	was no data before the recipient delimiter. In combination
	with the above bug, this could cause an address to grow
	exponentially in size.  Problem reported by Victor Duchovni,
	Morgan Stanley.  File:  global/split_addr.c.


	Bugfix: the mail_addr_map() fix was almost but not quite
	right. It took two clever people and several iterations of
	email to really fix the mail_addr_map() problem.  Thanks
	to Victor Duchovni and Liviu Daia.


	Cleanup: Postfix no longer flushes the whole deferred queue
	after an ETRN request for a random domain name (i.e. a
	domain name not matched by $fast_flush_domains); the SMTP
	server instead replies with "459 service unavailable".
	Files:  smtpd/smtpd.c, global/flush_clnt.c, flush/flush.c.


	Bugfix: there was a minute memory leak when an smtpd access
	restriction was misconfigured. File: smtpd/smtpd_check.c.


	Code cleanup: Postfix daemons now print the name of the
	UNIX-domain socket (instead of "unknown stream") in case
	of a malformed client request. Files:  master/*server.c.


	Code cleanup: replaced the ugly mail_print() and mail-scan()
	protocols by (name,value) attribute lists. This gives better
	error detection when we make changes to internal protocols,
	and allows new attributes to be introduced without breaking
	everything immediately. Files: util/attr_print.c util/attr_scan.c
	global/mail_command_server.c global/mail_command_client.c
	as wel as most Postfix applications and daemons.


	Put base 64 encoding into place on the replaced internal
	protocols.  Files: util/base64_code.[hc].

	Feature: header/body REJECT rules can now provide text that
	is sent to the originator. Files: cleanup/cleanup.c,
	cleanup/cleanup_message.c, conf/sample-filter.cf.


	Bugfix: As of 20000625, Errors-To: was broken, because the
	code to extract the address was not moved from recipient
	address rewriting to sender address rewriting. Problem
	reported by Roelof Osinga @ nisser.com. File:


	Bugfix: virtual map expansion terminated early because the
	detection of self-referential entries was flawed.  File:


	Bugfix: mail_date() mis-formatted negative time zone offsets
	with fractional hours (-03-30 instead of -0330). Fix by
	Chad House, greyfirst.ca. File: global/mail_date.c.


	Feature: new -f option to postmap and postalias (do not
	lowercase the lookup key while creating a table). Files:
	util/dict.h postmap/postmap.c postalias/postalias.c.

	Code cleanup: simplified the attribute print/scan routines,
	and removed the never-used support for sending and receiving
	integer arrays and string arrays. Files: util/attr_print.c,

	Bugfix: qmqpd could read past the end of a string while
	looking for qmail's VERP magic token in the envelope sender
	address.  File: qmqpd/qmqpd.c.

	Code cleanup: finished testing the new internal protocols.
	The only bug was with the flush server, which still needs
	to support the old (string + null byte) protocol for triggers
	from the Postfix master daemon.


	Bugfix: Postfix would log the wrong error text when locally
	submitted mail was deferred due to "soft_bounce = yes".

	Bugfix: The LDAP client dropped any entries that don't have
	the result_attribute, but errored out when a DN didn't
	exist.  The behavior is now consistent: treat non-existant
	DN's in a special result attribute expansion the same as
	DN's with no attribute.  LaMont Jones, HP.


	Bugfix: the new smtp-sink -n option (terminate after the
	specified number of deliveries) wasn't optional.

	Portability: updated Mac OS X documentation and install
	scripts by Gerben Wierda.


	Bugfix: missing terminator in new attribute-based function
	call caused signal 11. File: src/cleanup/cleanup.c.

	Lame workaround for ESTALE errors with mail delivery over
	NFS. Additional bandages were added to the local delivery
	agent. However, Wietse maintains that Postfix offers no
	guarantee for reliable delivery over NFS.

	Feature: put "warn_if_reject" before an smtpd restriction,
	and that restriction logs warnings without rejecting mail.
	This makes it easier to test configurations "live" without
	having to lose mail. File: smtpd/smtpd_check.c.


	Workaround: in order to get mail past PIX firewall bugs,
	the Postfix SMTP client now blocks until the socket send
	buffer is empty before sending the final ".<CR><LF>". Files:
	util/sock_empty_wait.c, smtp/smtp_proto.c. Changed into
	sleep(10) on 20011119. Sleep suggested by Hobbit.


	Feature: added string-null encoding for internal protocols.
	Files: util/attr_print0.c, util/attr_scan0.c.

	Feature: configurable parent domain matching for domain
	and hostname/address match lists: either .domain or the
	domain name itself. Files: util/match_ops.c util/match_list.c

	Feature: added pretend-to-be-behind-PIX mode to the smtp-sink
	test program, in order to stress test some PIX bug workaround


	Workaround: Linux and Solaris systems have no reasonable
	way to block until a socket drains. On these systems Postfix
	simply waits for 10 seconds, in order to work around PIX
	".<CR><LF>" bugs.  File: util/sock_empty_wait.c.


	Bugfix: reset the smtpd command transaction log between
	deliveries. File: smtpd/smtpd.c.


	Feature: mailbox_command_maps no longer requires that every
	user has an entry. If the user does not have a command
	entry, the local delivery agent tries the other delivery
	methods (mailbox_command, home_mailbox).  File: local/mailbox.c.

	Bugfix: reset the smtpd command transaction log between
	non-deliveries. File: smtpd/smtpd.c.


	Bugfix: consolidated all the command transaction log resets
	and eliminated one missing reset (Victor Duchovni, Morgan
	Stanley). File: smtpd/smtpd.c.


	Cleanup: replaced unnecessary match_list wrapper code by
	macros. Files:  global/{string,domain,namadr}_list.[hc].


	Feature: configurable parent domain matching strategy for
	transport map lookups. File:  trivial-rewrite/transport.c.

	New parent_domain_matches_subdomains parameter. This lists
	all the Postfix features where a domain name matches itself
	and all its subdomains (instead of requiring ".domain.name"
	for subdomain matches).  Planning for future backwards
	compatibility :-)  File:  global/match_parent_style.c.

	Workaround: simplified the PIX ".<CR><LF>" bug to always
	sleep for 10 seconds.  File: smtp/smtp_proto.c.


	Workaround: disable attribute string length restriction so
	that trivial-rewrite does not refuse to rewrite broken mail
	headers.  Files:  util/attr_scan*.c.


	Bugfix: missing long integer support in the new IPC protocols.
	Files: util/attr_scan*.c, util/attr_print*.c.

	Portability: AIX5 (Adrian P. van Bloois), MAC OS X 10.1.1
	(Gerben Wierda).


	Bugfix: spurious postmaster notifications because some flag
	was not reset.

	Feature: new parameter smtpd_sender_login_maps that specifies
	the (SASL) login name that owns a MAIL FROM address.
	Specify a regexp table in order to require a simple one-to-one
	mapping. This is used in the reject_sender_login_mismatch
	sender anti-spoofing feature.

	Feature: restriction reject_sender_login_mismatch refuses
	a MAIL FROM address when $smtpd_sender_login_maps specifies
	an owner but the client is not (SASL) logged in as the MAIL
	FROM address owner, or when a client is (SASL) logged in
	but the client login name does not own the MAIL FROM address
	according to $smtpd_sender_login_maps.  File: smtpd/smpd_check.c.

	Documentation: added some redundancy to the LMTP_README
	file so people can keep track of the difference between
	the Postfix LMTP client and the non-Postfix LMTP server.


	Feature: smtpd_noop_commands specifies a list of commands
	that are treated as NOOP (no operation) commands, without
	syntax check or state change.  File: smtpd/smtpd.c.

	Bugfix: the "mark queue file as corrupt" code did not work
	because it was never used.  Files: global/mark_corrupt.c,
	global/mail_copy.c, global/pipe_command.c, *qmgr/qmgr_active.c,
	local/maildir.c, local/mailbox.c, local/command.c, pipe/pipe.c,
	virtual/mailbox.c, virtual/maildir.c.

	Bugfix: the bounce daemon broke in the unlikely case of a
	non-existing queue file. File: bounce/bounce_notify_util.c.


	Feature: added WARN command to header/body_checks files as
	proposed by Michael Tokarev. File: cleanup/cleanup_message.c.

	Bugfix: the postdrop program was broken after the change
	of Postfix internal protocols. This broke "sendmail -bs"
	mail submissions with "secure" maildrop directory.  Reported
	by Craig Loomis, apo.nmsu.edu. File: postdrop/postdrop.c.

	Feature: a first start at fault injection for testing
	unlikely error scenarios (such as corrupt queue files).
	Parameter: fault_injection_code, must be left at zero for
	production use.


	Robustness: add a file size limit to the sendmail and
	postdrop submission programs to stop run-away process
	accidents. This is not a defense against DOS attack.  Files:
	sendmail/sendmail.c, postdrop/postdrop.c.

	That resulted in a considerable amount of work to properly
	propagate "file too large" conditions back to the sendmail
	mail posting user interface. Took the opportunity to express
	other mail submission fatal exits with the <sysexits.h>
	exit status codes.  Files: sendmail/sendmail.c,


	Maintenance: dict_ldap.c wasn't updated after the revision
	of the string matching routines. File: util/dict_ldap.c.


	Maintenance: LDAP module and documentation from LaMont
	Jones.  This version adds verbose logging for LDAP library
	routines. Files: src/util/dict_ldap.[hc], LDAP_README,

	Portability: made memory alignment restrictions configurable.
	File: util/mymalloc.c.

	Bugfix? Avoid surprises with source routed destinations
	and OK entries in SMTPD access maps. File: smtpd/smtpd_access.c.

	Security: "postfix check" looks for damage by well-intended
	but misguided use of "chown -R postfix /var/spool/postfix".
	That would make chrooted Postfix less secure than non-chrooted
	Postfix.  These extra tests may cause complaints with
	third-party patches such as TLS that introduce their own
	files into the jail.

	Feature: static map type that always returns the map name
	as lookup value, regardless of lookup key value. Contributed
	Jeff Miller (jeffm at ghostgun.com)

	Feature: turn off the PIX <CR><LF>.<CR><LF> workaround for
	the first mail delivery attempt, i.e. when mail is queued
	for less than $smtp_pix_workaround_threshold_time (default:
	500) seconds. New parameter $smtp_pix_workaround_delay_time
	to control the delay before sending .<CR><LF> (default: 10
	seconds) when doing the PIX <CR><LF>.<CR><LF> workaround.


	Bugfix: the 20011128 change in sendmail and postdrop did
	not handle the case of message_size_limit=0. Fix by Will
	Day, Georgia Tech.


	Compatibility: The SMTP server now accepts <CR><CR><LF> as
	if the client sent <CR><LF>. Reportedly, some badly written
	windows software produces such garbage, and some badly
	written windows anti-VIRUS software cannot handle such
	garbage. File:  global/smtp_stream.c.


	Bugfix: postmap/postalias queries ignored the -f flag.
	Reported by Hamish Marson.


	Compatibility: Sendmail now has a -L option to set the
	syslogging label. Postfix sendmail uses syslog_name instead,
	and ignores the -L option.

	Security: subtle hardening of the Postfix chroot jail,
	Postfix queue file permissions and access methods, in case
	someone compromises the postfix account.  Michael Tokarev,
	who received the insights from Solar Designer, who tested
	Postfix with a kernel module that is paranoid about open()
	calls.  Files:  master/master_wakeup.c, util/fifo_trigger.c,

	Convenience: issue a warning instead of aborting when the
	local machine name is not in fully-qualified domain form.
	This would otherwise break initial postfix installation
	which needs the postconf command. File: global/mail_params.c.


	Added more garbage detection to postconf -e input processing.


	Feature: SMTPD access map lookups of null sender addresses.
	If your access maps cannot store or look up null string
	key values, specify "smtpd_null_access_lookup_key = <>"
	and the null sender address will be looked up as <> instead.
	File:  src/smtpd_access.c.


	Safety: configuration file comments no longer span multiple
	lines when the next line begins with whitespace; multi-line
	input is no longer terminated by a comment line, by an all
	white space line, or by an empty line. Michael Tokarev made
	the crucial suggestion to simplify the readline routine.
	Files:  util/readlline.c, postconf/postconf.c.

	Cleanup: proper detection of big number overflow in EHLO
	and MAIL FROM size announcements, with input from Victor
	Duchovni, Morgan Stanley. Files: global/off_cvt.c,
	smtpd/smtpd.c, smtp/smtp_proto.c, util/alldig.c.

	Forward compatibility: added queue file record types for
	original recipient and for generic named attributes.

	Cleanup: safe_open() now returns sensible errno values so
	that the fifo_trigger() external interface is restored.


	Upgrade: PCRE_README now describes PCRE version 3.x.

	Cleanup: flush SMTPD command history upon receipt of EHLO,
	RSET, and upon DATA completion, only if it exceeds
	$smtpd_history_flush_threshold lines (default: 100).
	Distant derivative of code by Michael Tokarev.  File:


	Bugfix: a readlline() error message showed less text than
	intended. Christian von Roques.

	Cleanup: postfix now installs with group-writable maildrop
	directory and with a set-gid postdrop mail submission
	command.  The pickup service is now unprivileged.  The
	world-writable maildrop directory no longer exists.

	The cleanup service is now public, in preparation for local
	sendmail/postdrop mail submission that avoids the maildrop
	queue directory while Postfix is up.

	Cleanup: moved the main.cf/master.cf file editing from the
	postfix-script file to the INSTALL.sh file.

	Cleanup: INSTALL.sh no longer accepts "no" as the destination
	of Postfix manual pages.


	Cleanup: the code for "mailq", "sendmail -q", and for
	"sendmail -qRsite" was moved from the sendmail command to
	a new set-gid postqueue command. The pickup and qmgr FIFOs
	are no longer world writable. Files: sendmail/sendmail.c,


	Security: new alternate_config_directories parameter that
	specifies what directories a set-gid command will accept
	as its configuration directory. The list must be specified
	in the default main.cf file. File: global/mail_conf.c.

	Cleanup: "sendmail -qRsite" is no longer implemented by
	connecting to the SMTP port. It is now implemented by
	talking to the fast flush service. File: postqueue/postqueue.c.


	Cleanup: INSTALL.sh now records all installation information
	in the main.cf file. The now obsolete install.cf file is
	used only when upgrading from an older Postfix release.

	Cleanup: INSTALL.sh now takes name=value settings on the
	command line, and has a new "-upgrade" command line option
	to turn on non-interactive installation.

	Security: additional run-time checks to discourage sharing
	of Postfix user/group ID values with other accounts.


	Cleanup: SMTPD access maps now return DUNNO (undetermined)
	instead of OK when a recipient address contains multiple
	domains (user@dom1@dom2, etcetera).  Victor Duchovni, Morgan
	Stanley.  File:  smtpd/smtpd_check.c.


	Bugfix: SMTPD access maps did not handle address extensions.
	File: smtpd/smtpd_check.c.


	Bugfix: postfix-script, when creating a missing maildrop
	queue directory, still referenced install.cf when setting
	maildrop directory group ownership; and the postfix command
	did not export the setgid_group parameter to the postfix-script
	shell script.  Victor Duchovni.

	Bugfix: postfix-script, when creating a missing public
	queue directory, did not set group ownership of the public


	Cleanup: rewrote the Postfix installation procedure again.
	It is now separated into 1) a primary installation script
	(postfix-install) that installs files locally or that builds
	a package for distribution and that stores file owner and
	permission information in /etc/postfix/post-files, and 2)
	a post-installation script (/etc/postfix/post-install) that
	creates missing directories, that sets file/directory
	ownership and permissions, and that upgrades existing
	configuration files if necessary.


	Workaround: AIX null read() return on an empty but open
	non-blocking pipe. File:  master/master_flow.c.  Report:
	Hamish Marson.


	Feedback: feedback, bugfixes, and brain-dead shell workarounds
	for the install scripts by Victor Duchovni and Simon Mudd.


	Rewrote postfix-install. The postfix-files file now controls
	what is installed.  Refined the semantics of many post-install
	operations. post-install now auto-saves settings that
	override main.cf.


	Bugfix: alternate_config_directories did not take comma or
	whitespace as separators. File: global/mail_conf.c.  Victor
	Duchovni, Morgan Stanley.

	Bugfix: the rewritten postfix-install script did not chattr
	+S the Postfix queue.


	Cleanup: added sample_directory and readme_directory
	installation parameters for sample configuration files and
	for README files. Files: postconf.c, postfix-install,
	conf/postfix-files, conf/post-install.

	Robustness: the postfix command now exports all installation
	parameter settings, and input filters the environment, so
	that the startup shell scripts produce a consistent result.
	Files: postconf.c.


	Portability: patch from LaMont Jones for compiling dict_ldap.c
	with the Netscape SDK.

	Feature: added "r" (recursive chown/chgrp) flag to the
	postfix-files database, for more convenient change of
	Postfix queue ownership. Files: conf/postfix-files,


	Documentation: lots of little fixes.

	Documentation: updates for the VIRTUAL_README file by Victor
	Duchovni, Morgan Stanley.

	Bugfix: postqueue -s dereferenced a null pointer when given
	a numerical domain argument. LaMont Jones, HP.

	Cleanup: smtpd now logs a warning when permit_sasl_authenticated
	is used while SASL authentication is disabled, instead of
	simply ignoring the restriction. LaMont Jones, HP. File:

	Safety: when postmap creates a non-existent file, the new
	file inherits group/other read permissions from the source
	file.  Based on code by LaMont Jones, HP.  File:


	Portability: some Linux systems install libnsl.so without
	libnsl.a file, causing an yp_match undefined reference
	problem.  File: makedefs.


	Portability: post-install now requests that command_directory
	is given on the command line when the postconf command is
	in an unusual place.

	Safety: extra code to detect and report Berkeley DB version
	mismatches between compile time and run time.  This test
	is limited to mismatches in the major version number only.
	File:  util/dict_db.c. Based on code by Lawrence Greenfield,
	Carnegie-Mellon university.

	Safety: the postfix command and the master daemon abort if
	they are running set-uid.

	Documentation: the postmap manual page described an out of
	date input file format.


	Workaround: SCO version 3.2 can't ioctl(FIONREAD) a pipe.
	Therefore, input mail flow control is disabled by default.
	Files:  makedefs, global/mail_params.h, conf/main.cf.
	Problem reported by Kurt Andersen, Agilent.


	Workaround: changed the default smtpd_null_access_lookup_key
	setting to <>, because some Bezerkeloid DB implementations
	can't handle null-length lookup keys.  File: global/mail_params.h.

	Bugfix: backed out a null-length address panic call by
	ignoring the problem, like Postfix did in the past.  File:

	Safety: "postfix check" will now warn if /usr/lib/sendmail
	and /usr/sbin/sendmail differ, and will propose to replace
	one by a symlink to the other. File: conf/postfix-script.


	Sanity: additional permission checks for "postfix check"
	that warn for setgid_group group ownership mismatches.  by
	Matthias Andree, uni-dortmund.de. File: conf/postfix-script.

	Bugfix: "postfix check" used a too simplistic way to
	recognize file ownership (grepping ls output). It now uses
	the recently discovered "find -prune".  Peter Bieringer,
	Matthias Andree. File: conf/postfix-script.


	Workaround: log a warning and disconnect when an SMTP client
	ignores our negative replies and starts sending message
	content without permission. File: smtpd/smtpd.c.


	Bugfix: mismatch in the file being locked by dict_dbm and
	the file being locked by postmap, so that locks did not
	work correctly.  Victor Duchovni, Morgan Stanley.


	Workaround: Solaris bug 4380626: strcasecmp() and strncasecmp()
	produce incorrect results with 8-bit characters. For example,
	non-ASCII characters could compare equal to ASCII characters,
	and that could result in any number of security problems.
	Files:  util/strcasecmp.c, COPYRIGHT (the BSD license).

	Bugfix: off-by-one error, causing a null byte to be written
	outside dynamically allocated memory in the queue manager
	with addresses of exactly 100 bytes long, resulting in
	SIGSEGV on systems with an "exact fit" malloc routine.
	Experienced by Ralf Hildebrandt; diagnosed by Victor
	Duchovni. Files:  *qmgr/qmgr_message.c.  This is not a
	security problem.

	Bugfix: make all recipient comparisons transitive, because
	Solaris qsort() causes SIGSEGV errors otherwise. Victor
	Duchovni, Morgan Stanley. File: *qmgr/qmgr_message.c.


	Bugfix: don't strip source route (@domain...:) when the
	result would be an empty address. This avoids problems when
	append_at_myorigin is set to "no" (which is not supported).
	Problem reported by Charles McColgan, Big Fish Communications.
	File:  trivial-rewrite/rewrite.c.


	Cleanup: postqueue should not not complain when output
	fails with "broken pipe".


	Bugfix? reply with 550 not 552 when content is rejected.
	552 is reserved for "too much mail".

	Documentation: add note to sendmail manual page that running
	"sendmail -bs" as $mail_owner enables SMTP server UCE and
	access control checks. This is meant for use from inetd
	etc.  Matthias Andree.


	Bugfix: DBM maps should use different files for locking
	and for change detection.  Problem reported by Victor
	Duchovni, Morgan Stanley.  Files: util/dict.h util/dict.c
	util/dict_db.c util/dict_dbm.c global/mkmap.c local/alias.c.


	Bugfix: mailq could show addresses with unusual characters
	twice.  Problem reported by Victor Duchovni, Morgan Stanley.
	File: showq/showq.c.

	Bugfix: null recipients weren't properly recorded in
	bounce/defer logfiles. Such recipient addresses are not
	accepted in SMTP mail, but they could appear within locally
	submitted mail.  File: bounce/bounce_append_service.c.


	Workaround: Berkeley DB can't handle null key lookups,
	which happen with HELO names ending in ".".  Victor Duchovni,
	Morgan Stanley. File: smtpd/smtpd_check.c.

	Logging: log a hint when mail is deferred because the
	soft_bounce parameter is set. People sometimes forget to
	turn it off. File: global/bounce.c.


	Cleanup: add a msg_warn() call when fork() fails in
	pipe_command(), to make problems easier to investigate.
	Chris Wedgwood. File:  global/pipe_command.c.


	Feature: smtp_helo_name parameter to specify the hostname
	or [ip.address] in HELO or EHLO commands. Files: smtp/smtp.c


	Cleanup: more graceful handling of long physical message
	header lines upon input. Physical header lines can now
	extend up to $header_size_limit characters. When a logical
	message header is too long, the excess text is discarded
	and Postfix no longer switches to body mode, to avoid
	breaking MIME encapsulation.  Based on code by Victor
	Duchovni, Morgan Stanley.  Files:  cleanup/cleanup_out.c,

	Cleanup: more graceful handling of long physical message
	header or body lines upon output by the SMTP client. The
	SMTP client output line length is controlled by a new
	parameter smtp_line_length_limit (default: 990; specify 0
	to disable the limit). Long lines are folded by inserting
	<CR> <LF> <SPACE>, to avoid breaking MIME encapsulation.
	Based on code by Victor Duchovni, Morgan Stanley.  File:


	Cleanup: allow additional text after a WARN command in a
	header/body_checks pattern file, so that one can change
	REJECT+text into WARN+text and vice versa. Based on code
	by Fredrik Thulin, Stockholm University.

	Cleanup: log a warning when an unknown command is found in
	a header/body_checks pattern file, or when additional text
	is found after a command that does not expect additional
	text. Based on code by Fredrik Thulin, Stockholm University.

	Bugfix: sendmail should not recognize "." as the end of
	input when the current read operation started in the middle
	of a line.  Victor Duchovni, Morgan Stanley. File:


	Portability fix for OPENSTEP and NEXTSTEP by Gerben Wierda.
	File: util/sys_defs.h.


	Bugfix: defer_transports broke because the flush server
	triggered mail delivery (as if ETRN was sent) while doing
	some internal housekeeping of per-destination logfiles.
	Problem experienced by LaMont Jones, HP. File: flush/flush.c.

	Bugfix: virtual mapping broke for addresses with embedded
	whitespace. Fix by Victor Duchovni, Morgan Stanley. File:

	Feature: configurable service name for the internal services:
	bounce, cleanup, defer, error, flush, pickup, queue, rewrite,
	showq. This allows you to specify, for example, a non-default
	cleanup service (smtpd -o cleanup_service_name=alt_cleanup).
	Files: global/mail_params.[hc].

	Feature: SASL version 2 support by Jason Hoos. Files:
	*/*_sasl_glue.c, SASL_README, conf/sample-auth.cf.


	Bugfix: postqueue did not pass on non-default configuration
	directory settings when running showq while the mail system
	is down.  The super-user is now exempted from environment
	stripping in postqueue/postqueue.c. Problem reported by
	Victor Duchovni, Morgan Stanley.


	Workaround: recognize more headers that are sent instead
	of SMTP commands. File: smtpd/smtpd.c.


	Feature: new pipe delivery agent "D" flag to prepend a
	Delivered-To:  message header. This requires single recipient
	deliveries. Based on code by Matthias Andree. File:


	Portability: Postfix will no longer attempt to build with
	gdbm support, because gdbm is broken. File:  makedefs.


	Cleanup: the attribute list IPC code did not distinguish
	between "disconnect" and "timeout" while reading an attribute
	list, making trouble shooting more difficult than necessary.
	Files:  util/attr_scan0.c, util/attr_scan64.c.

	Cleanup: install parameter defaults can now be overruled
	from makedefs: sendmail_path, mailq_path, newaliases_path,
	command_directory, daemon_directory. Based on code by Victor
	Duchovni, Morgan Stanley. File: util/sys_defs.h.


	Cleanup: Use more robust quoting passing makedefs/Makefile
	settings. This also simplifies the seven backslashes example
	in the INSTALL file.  Victor Duchovni, Morgan Stanley.
	Files: makedefs, INSTALL.


	Bugfix: the post-install script failed to upgrade master.cf
	settings from private to public if the service was explicitly
	configured as private.


	Documentation: added CPU saving patterns for quickly skipping
	base 64 encoded text in message bodies.  Liviu Daia.  Files:
	{proto,conf}/pcre_table, {proto,conf}/regexp_table,


	Bugfix: the SMTP client forgot to quote whitespace etc.
	in a sender/recipient address when DNS lookup was turned
	off (disable_dns_lookups = yes). Problem experienced by
	Chip Paswater. Files: smtp/smtp_proto.c.


	Feature: wildcard lookup in transport maps (lookup key
	"*").  Code developed with Lamont Jones, HP.

	Feature: a null transport:destination transport map entry
	means proceed as if the transport map lookup failed.  Code
	developed with Lamont Jones, HP.

	Feature: more efficient use of cache memory when a process
	opens multiple Berkeley DB tables; and faster performance
	creating large tables by using more buffer memory. Files:
	util/dict_db.[hc], global/mkmap_db.c. Victor Duchovni,
	Morgan Stanley.


	Cleanup: postqueue silently ignored command-line arguments
	following -p or -f options, instead of complaining; postqueue
	produced an incorrect error message (mail system down) when
	the command was installed with incorrect privileges.  File:

	Bugfix: while reporting a domain name or IP address syntax
	error, postqueue could dereference a dangling pointer with
	some getopt() implementations. LaMont Jones, HP.  File:

	Safety: postalias and postmap now drop root privileges
	while processing a non-root input file. Thus, the result
	should be writable to the source file owner. Specify the
	-o option if this is a problem. Files: postmap/postmap.c,

	Consistency: just like postmap, postalias now copies file
	permissions from the source file when it creates a new
	table for the first time. File: postalias/postalias.c.


	Portability: run-time test to avoid GDBM trouble.  File:


	Cleanup: revised and simplified the transport map semantics.
	Null transport or nexhop fields now mean: "do not change":
	use what would be used if the transport map did not exist.
	This change eliminated a lot of code. The incompatibility
	is that a null transport field no longer defaults to
	$default_transport, but to $local_transport or $default_transport
	depending on the destination, and that a transport map only
	overrides relayhost when the table specifies explicit
	nexthop information.  Files:  trivial-rewrite/transport.c,

	Cleanup: revised the user interface for controlling the
	Berkeley DB create and read buffer size controls. Files:
	util/dict_db.[hc], global/mail_params.[hc], global/mkmap_db.c.


	Cleanup: simplified the hash/btree cache management code.
	The caches are now per table instead of shared, and the
	default read cache size is reduced to 128 kBytes. File:


	Bugfix: close user@domain@postfix-style.virtual.domain
	source routing relaying loophole involving postfix-style
	virtual domains with @virtual.domain catch-all patterns.
	Problem reported by Victor Duchovni. File:  smtpd/smtpd_check.c.

	Bugfix: mail_addr_map() used the "wrong" @ character in
	addresses with multiple @. Victor Duchovni. File:

	Bugfix: for address localpart quoting, now quote @ as a
	special character everywhere, except when resolving addresses.
	Previously, the @ was nowhere quoted as a special character,
	not even in SMTP commands.  Files:  global/quote_82[12]_local.c
	and clients.


	Safety: don't allow an OK access rule lookup result for
	user@domain@postfix-style.virtual.domain. Suggested by
	Victor Duchovni, Morgan Stanley. File: smtpd/smtpd_check.c.

	Bugfix: quote unquoted address localparts that need quoting.
	Files: global/tok822_parse.c, global/quote_82[12]_local.c.

	Documentation: simplified the advanced content filtering
	example, and included a more advanced example for those
	who want to squeeze out more performance without running
	multiple Postfix instances.  Text by Victor Duchovni, Morgan


	Feature: header/body filters now log the origin of the
	message that is being rejected. Files: smtpd/smtpd.c,
	qmqpd/qmqpd.c, pickup/pickup.c, cleanup/cleanup_envelope.c,
	cleanup/cleanup_message.c.  Requested by Craig Sanders, if
	I remember correctly.

	Feature: the Postfix SMTP client now passes on MIME body
	type information (8bit, 7bit) received via SMTP, via MIME
	headers, or via the sendmail command line. Files:
	global/deliver_request.c, smtpd/smtpd.c, sendmail/sendmail.c,
	cleanup/cleanup_envelope.c, cleanup/cleanup_message.c,
	cleanup/cleanup_extracted.c, *qmgr/qmgr_message.c,
	*qmgr/qmgr_deliver.c, smtp/smtp_proto.c, lmtp/lmtp_proto.c.


	Feature: bounces now specify the proper MIME encoding (8bit,
	7bit), depending on the MIME body type information received
	via SMTP, via MIME headers, or via the sendmail command
	line. Files: global/bounce.c, global/defer.c, global/abounce.c,
	bounce/bounce_service.c, bounce/bounce_notify_util.c.


	Cleanup: the SMTP client logged and bounced the CNAME
	expanded recipient address, and thereby complicated trouble
	shooting.  File:  src/smtp_proto.c.

	Bugfix: the SMTP and LMTP clients bounced the quoted
	recipient address, resulting in too much quoting in bounce
	reports.  Files:  src/smtp_proto.c, lmtp/lmtp_proto.c.


	Bugfix: the LDAP client used the "wrong" @ character in
	addresses with multiple @. LaMont Jones, HP. File:

	Feature: lots of new LDAP stuff: result_filter (filter to
	expand results from queries), chase_referrals, LaMont Jones,
	HP. The LDAP bind timeout now works thanks to Victor
	Duchovni, Morgan Stanley. File:  util/dict_ldap.c.

	Cleanup: specify "resolve_dequoted_address = no" to prevent
	Postfix from looking inside quotes for extra @ etc. characters
	when resolving an address. This behavior is technically
	more correct, but it opens a mail relay loophole with "user
	@domain"@domain when relaying mail to a Sendmail system.


	Bugfix: the new code for header address quoting sometimes
	did not null terminate strings so that arbitrary garbage
	could appear at the end of message headers.  Reported by
	Ralf Hildebrandt.  File:  global/tok822_parse.c.

	Safety: user@domain@domain is no longer accepted by the
	permit_mx_backup uce restriction (unless Postfix is configured
	with "resolve_dequoted_address = no"). Victor Duchovni,
	Morgan Stanley. File: smtpd/smtpd_check.c.


	Workaround: flush the SMTP client output buffer when no
	output has happened for 10+ seconds. This prevents the
	socket from timing out, in case DNS CNAME expansion is
	slow.  Problem experienced by Alex Erdelyi, peregrine.com.
	File:  smtp/smtp_chat.c. We did the same thing for the SMTP
	server years ago, and one wonders why the coin didn't drop
	at the time that the SMTP client could suffer from a similar


	Updated the FILTER_README file to turn off DNS lookups in
	the SMTP client that feeds mail into a content filter.


	Cleanup: Mailbox-Line: message header labels should be
	X-Mailbox-Line:  labels. Files: smtpd/smtpd.c, qmqpd/qmqpd.c.


	Feature: new MIME parser, written from scratch, that
	recognizes the structure of MIME encapsulated mail. Influenced
	by comments from Victor Duchovni. This code can detect but
	will not decode obscure MIME formats or obscure character
	string encoding that Liviu Daia expresses concern about.

	MIME header scanning now happens in header_checks, and is
	faster than body_checks could ever be. This also eliminates
	the problem with multi-line MIME headers being matched one
	line at a time.  Files:  global/mime_state.[hc],


	Feature: 8-bit to quoted-printable conversion. First use
	in the Postfix SMTP client. File: smtp/smtp_proto.c.

	Logging: the Postfix SMTP and LMTP clients now report the
	the protocol stage when they report a server reply.  File:
	smtp/smtp_proto.c, lmtp/lmtp_proto.c.

	Bugfix: the SMTP server warned about ignored client attributes
	(these were introduced 20020510) in mail that was submitted
	with "sendmail -bs".  File: smtpd/smtpd.c.


	Feature: separation of header checks into header_checks
	(all primary headers except MIME related headers),
	mime_header_checks (all MIME headers including MIME headers
	at the start of messages) and nested_header_checks (headers
	of attached messages, except MIME related headers).

	Cleanup: broke out the header value parser from the MIME
	processor so that the code can be reused elsewhere. File:

	Compatibility: Postfix now recognizes "name :" as a valid
	message header, but normalizes it to "name:" form or else
	lots of things would break all over the place.  Files:
	global/is_header.c, global/mime_state.c.


	Bugfix: the SMTP server now disallows RCPT TO:<"">, just
	like it disallows RCPT TO:<>.  File: smtpd/smtpd.c.

	Feature: disable_mime_input_processing=yes/no controls
	whether Postfix recognizes (and optionally enforces) MIME
	formats while receiving mail. Default is NO.

	Feature: disable_mime_output_conversion=yes/no controls
	whether Postfix will convert 8BITMIME to 7BIT mail when
	delivering mail to an SMTP server that does not announce
	8BITMIME support.  Default is NO.

	Feature: strict_8bitmime=yes/no controls whether Postfix
	rejects 8-bit characters in headers and 7-bit body parts.
	This blocks mail from poorly written software, including
	majordomo approval requests that contain a valid 8BITMIME
	email message, as well as mail that is piped into ancient
	/bin/mail implementations that do not MIME format 8-bit
	content. Default is NO.

	Feature: strict_mime_encoding_domain=yes/no controls whether
	Postfix rejects illegal content transfer encodings for
	multipart/* and message/*. This blocks mail from poorly
	written software. Default is NO.


	Feature: "FILTER transport:nexthop" in header/body checks.
	After the message is queued, the message is sent through
	a content filter. This requires different cleanup servers
	before and after the filter, with header/body checks turned
	off in the second cleanup server.


	Feature: strict_7bit_headers and strict_8bitmime_body are
	now separately available. To to turn on both, use

	Cleanup: abandon the use of isspace(3) in the parsing of
	RFC822 message headers. Files: global/lex_822.h and lots
	of little places.

	Documentation: replace domain.name by domain.tld in the
	example config files. The domain exists. They were getting
	mail from poorly configured Postfix boxes.

	Bugfix: The Postfix sendmail command did not export the
	MAIL_CONFIG environment setting to the postdrop command.
	File: global/mail_config.h.

	Incompatibility: by default, turn on the PCRE_DOTALL flag,
	so that PCRE patterns will match multi-line message headers
	without causing pain. Suggested by Michael Tokarev. Also
	documented all those darned undocumented PCRE flags in the
	pcre_table(5) manual page. Files:  util/dict_pcre.c,


	Bugfix: mail rejected due to MIME errors was rejected
	without proper logging. Files: global/mime_state.c,


	Bugfix: the SMTP client code that prepends '.' to lines
	starting with '.' had to be moved from its old place to
	after the MIME output conversion. Problem found by Mark
	Martinec.  File: smtp/smtp_proto.c.


	Bugfix: the deliver_pass() routine needed updating for the
	extra MIME encoding attribute that was introduced 20020510.
	Patch by Sebastian Schaffert @ wastl.net.  File:


	Workaround: Solaris non-blocking read() can fail on a socket
	with unread data according to ioctl FIONREAD.  Incredible.
	Diagnosis by Max Pashkov.  File:  smtp/smtp-sink.c.

	Weird feature: sender-based routing. This will become more
	useful once per-address transport map entries are done.
	File:  src/*qmgr/qmgr_message.c.


	Safety: header_address_token_limit limits the amount of
	memory and CPU that we're willing to spend while parsing
	addresses in message headers. The limit is expressed as a
	number of tokens. File: global/tok822_parse.c


	Feature: user@domain transport map lookup, based on code
	by Scott Cotton, from several years ago. Adding this code
	now was much less painful than it was in the past. Files:
	global/strip_addr.c, trivial-rewrite/transport.c.


	Cleanup: making user@domain transport map lookups work with
	sender-based routing was a bit tricky, because the null
	address must be handled sensibly. Files: global/resolve_clnt.c,
	trivial-rewrite/resolve.c. It ain't perfect yet, but close.


	Bugfix: postsuper -r was broken as of 20020510. The cleanup
	daemon would discard mail with MIME type information. Moved
	a bunch of sanity checks from the cleanup daemon to the
	pickup daemon, so the checks are in one place.  Problem
	experienced by Pavol Luptak. Files: pickup/pickup.c,


	Safety: log a warning when a domain is listed in mydestination
	and (virtual_maps or virtual_mailbox_maps).  This configuration
	error causes the Postfix SMTP server to reject recipients
	when the local_recipient_maps feature is enabled.  File:


	Portability: in the master daemon, the default now is to
	enable the signal handler code that writes a byte into a
	pipe, instead of the signal handler code that sets a global
	flag and hopes that select() will somehow wake up. File:
	master/master_sig.c. This is needed for some IRIX and
	UnixWare versions, but it should also produce a robust
	result on all other supported systems.

	Performance: the default SMTP connection establishment
	timeout is now 30 seconds, instead of the system default
	which can be atrociously large.


	When DNS lookup fails while delivering mail, report not
	only the domain name but also the DNS record type.  This
	should clue in people who ask why Postfix can't find a
	domain while nslookup can.  File:  dns/dns_lookup.c.


	Bugfix: undo change made at 20020610 that causes the trivial
	resolver client to loop when an address consists entirely
	of @ and . characters.  File: trivial-rewrite/resolve.c.

	Cleanup: Postfix no longer strips multiple '.' at the end
	of a domain name. One '.' is silently tolerated. Files:
	trivial-rewrite/rewrite.c, trivial-rewrite/resolve.c,
	global/resolve_local.c. This policy is too distributed.


	Feature: @domain.tld catch-all map entries for the virtual
	mail delivery agent. Files: global/virtual8_maps_find.c,
	virtual/mailbox.c, smtpd/smtpd_check.c.

	Feature: the virtual mail delivery agent now accepts address
	extensions (user+foo@domain.tld), ignores them when looking
	up users in its tables, but displays them in Delivered-To:
	message headers.  File: global/virtual8_maps_find.c.


	Feature: domain names in a masquerade_domains list can now
	be prefixed with !, in order to disable masquerading for
	that domain name and for its subdomains. File:


	Bugfix: Mac OS X niscript (Netinfo) update by Gerben Wierda.
	File: auxiliary/MacOSX/niscript.

	Feature: The SMTP server reject_unknown_whatever restrictions
	now also attempt to look up AAAA (IPV6 address) records.
	Jun-ichiro itojun Hagino, IIJ labs. Files: smtpd/smtpd_check.c,


	Bugfix: unnecessary lookups for extended addresses by the
	virtual8_maps_find() routine. Victor Duchovni. His patch
	did not work, nor did my own, but the present version should
	be OK. File: global/virtual8_maps_find.c.


	Workaround: log a warning when an SMTP client name->address
	lookup results in a numeric IP address, and set the client
	hostname to "unknown". Some gethostbyname() implementations
	will actually accept such garbage and thereby allow sites
	to defeat the "reject_unknown_client" restriction. Problem
	reported by Wolfgang Rupprecht, fix based on analysis (but
	not code) by Victor Duchovni.

	Bugfix: memory leaks in the LDAP client by Victor Duchovni.
	File: util/dict_ldap.c.

	Bugfix: garbage in verbose "flush" server logging. Victor
	Duchovni.  File: flush/flush.c.


	Incompatibility: smtpd_sasl_local_domain now defaults to
	the null string. File: smtpd/smtpd.c, smtpd/smtpd_sasl_glue.c.


	Documentation: added GDB debugging instructions for sites
	that do not have X installed on the Postfix machine. Henrik
	Larsson, spambox.dk.


	Weird: installed RedHat 3.03 inside VMware, and no change
	was needed to build Postfix, except to recognize the Linux

	Bugfix: some mailers will announce ESMTP features in their
	HELO (not EHLO) response. Postfix did not ignore them.
	File: smtp/smtp_proto.c.


	Cleanup: permit_naked_ip_address is unsafe (especially when
	used with smtpd_recipient_restrictions) and will go away.
	Postfix now logs a warning. File: smtpd/smtpd_check.c.


	Cleanup: the warning message for matched header/body content
	was misleading. File: cleanup/cleanup_message.c.

	Safety: moved the "postsuper -r ALL" operation after the
	"postsuper -s" check that makes queue file names match
	inode numbers. This avoids loss of mail in the unlikely
	case that someone runs "postsuper -sr ALL" on a queue that
	was copied from another place.

	Feature: "postsuper -h" to put mail "on hold" and "postsuper
	-H" to release mail that was placed "on hold". This involves
	a new queue, which is appropriately named "hold".  Files:
	postsuper/postsuper.c, showq/showq.c.


	Feature: when a Delivered-To: mail delivery loop is detected,
	send the bounce to the mailing list owner. This required
	changes to the local delivery agent, a new bounce client
	stub, and a new bounce server stub and support routines
	for one recipient bouncing. Files: local/recipient.c,
	global/bounce_log.c, global/bounce.c, bounce/bounce.c,
	bounce/bounce_notify_util.c, bounce/bounce_one_service.c.


	Bugfix: the 20020531 bugfix could prepend '.' to lines when
	it shouldn't (but only when converting 8-bit mail to 7-bit).
	Problem experienced by Ralf Hildebrandt.  File:

	Bugfix: smtpd_sender_login_maps did not do the @domain etc.
	wild-card lookups that were promised. Problem experienced
	by Sven Michels. File: smtpd/smtpd_check.c.


	Feature: new smtp-sink command-line options to specify the
	SMTP hostname, to disable ESMTP protocol support, to disable
	8BITMIME support, and to syslog selected commands.  File:


	Feature: the queue manager now warns when mail for some
	destination is piling up in the active queue, and suggests
	a variety of remedies.  The qmgr_clog_warn_time parameter
	controls the time between warnings, mainly so that I could
	test the code. To disable these warnings, specify
	"qmgr_clog_warn_time = 0". Files:  *qmgr/qmgr_entry.c.


	Paranoia: truncate the DNS response length result value in
	case it is larger than the result buffer length (the resolver
	documentation is vague about this). File:  dns/dns_lookup.c.


	Cleanup: "postqueue -f" now also triggers delivery of mail
	in the maildrop directory. This is needed when the master
	does not frequently wake up the pickup service.  Files:
	global/mail_flush.c, postqueue/postqueue.c.


	Cleanup: the qmgr_site_hog_factor feature is gone (defer
	mail if a site uses up too much space in the active queue).
	Instead, the qmgr_clog_warn_time feature provides better
	solutions. File: qmgr/qmgr_message.c.


	Feature: new header/body_checks HOLD pattern that causes
	mail to be placed on the "hold" queue for manual inspection.
	Files: global/hold_message.[hc], cleanup/cleanup_message.c.


	Bugfix: yesterday's HOLD pattern code did not update the
	cleanup server's idea of the queue file name for error
	recovery and for error reporting purposes, so that incomplete
	or content rejected mail would not be deleted from the
	queue, and so that the bouncer would not find the queue

	Bugfix: the #ifdef that detects too old LDAP libraries was
	in the wrong place.  Victor Duchovni.  File: util/dict_ldap.c.

	Feature: new header/body_checks DISCARD pattern that causes
	mail to be silently discarded. Files: global/cleanup_user.h,
	cleanup/cleanup_message.c, cleanup/cleanup_api.c.

	Bugfix: the local delivery agent's mailbox duplicate delivery
	eliminator was not updated in the days that address extensions
	were added to Postfix. The other local duplicate eliminators
	probably need revision as well. File: local/mailbox.c.


	Feature: HOLD and DISCARD actions in SMTPD access tables.
	These requests are propagated to the cleanup daemon.  Files:
	cleanup/cleanup_envelope.c smtpd/smtpd_check.c.

	Cleanup: eliminate unnecessary references to the obsolete
	program_directory configuration parameter (but keep the
	parameter so as to not break existing installations).
	Matthias Andree, many little changes in documentation.


	Bit Rot: OpenLDAP incompatible change with URL parsing.
	Patches by Will Day, Georgia Tech, and Carsten Hoeger,
	SUSE.  File: util/dict_ldap.c.


	Bugfix: added a missing memset() call to wipe the lookup
	key in dict_db_delete(). This is needed by some Berkeley
	DB implementations. Patch by Katsu Yamamoto, Fujitsu.

	Bugfix: when permit_mx_backup is unable to make a decision
	due to DNS problems, set the "defer if reject" flag so that
	other restrictions will not cause mail to be rejected.
	File: smtpd/smtpd_check.c.

	Feature: instead of giving up immediately after DNS failure,
	turn on the "defer_if_permit" flag when reject_unknown_hostname,
	reject_unknown_sender_domain or reject_unknown_recipient_domain
	are unable to make a decision, and see if any subsequent
	restrictions would still cause the mail to be rejected.
	File:  smtpd/smtpd_check.c.

	Feature: "FILTER transport:nexthop" is now also available
	in SMTPD access tables.


	Workaround: HP-UX 11 accept() fails with ENOBUFS when the
	client disconnects early. File: sane_accept.c.


	Cleanup: postfix-install no longer installs all the manual
	pages under $POSTFIXSOURCE/man, so we can generate manual
	pages for smtp-sink etc.  File: man/Makefile.in.


	Bugfix: the rmail script should have been updated when
	Postfix sendmail was changed to recognize `.' as the end
	of input.  Problem fix by Christian Kratzer, cksoft.de.
	File:  auxiliary/rmail/rmail.

	Feature: specify "maximal_queue_lifetime = 0" for mail that
	should be returned immediately after the first unsuccessful
	delivery attempt. Files: qmgr/qmgr.c, nqmgr/nqmgr.c.


	Bugfix: qmail compatibility: qmqpd should support any
	character at the end of the VERP prefix in prefix@host-@[].
	Based on a patch by LaMont Jones, HP.


	Feature: "smtpd_data_restrictions = reject_unauth_pipelining"
	blocks mail from SMTP clients that send message content
	before Postfix has replied to the DATA command.  File:
	smtpd/smtpd.c, smtpd/smtpd_check.c.

	Bugfix: the LDAP client dumped core in verbose mode.
	Reported by Will Day and others.  File: util/dict_ldap.c.


	Cleanup: dict_regexp module speedups by avoiding unnecessary
	substring overhead while matching strings. Based on a
	suggestion by Liviu Daia. This involved major rewriting of
	the regexp map code.  File: util/dict_regexp.c.


	Feature: IF..ENDIF support based on code by Bert Driehuis.
	This involved a further rewrite of the regexp map code.
	File: util/dict_regexp.c.


	Bugfix: the SMTP client produced suprious warnings about
	trouble with fallback_relay hosts. File:  smtp/smtp_connect.c.

	Robustness: don't wait with detecting broken SMTP connections
	until reading input. Leandro Santi. File: smtpd/smtpd_chat.c.


	Workaround: IRIX 6 can't do ioctl FIONREAD on pipes. This
	breaks the in_flow_delay feature.  File:  util/sys_defs.h.


	Bugfix: canonical/virtual mapping core dump with a null
	right-hand side address. Report by Jussi Silvennoinen.
	File: global/mail-addr_crunch.c.

	Feature: IF..ENDIF support based on code by Bert Driehuis.
	This involved a rewrite of the pcre map code similar to
	the regexp map code.  File:  util/dict_pcre.c.


	Feature: on Linux, support for PCRE lookup tables is now
	compiled in if the PCRE library code is found under
	/usr/include and /usr/lib.  File: makedefs.


	Documentation: postsuper(1) did not document the -c option.

	Bugfix: possible longjump() before setjmp(). File:

	Bugfix: pickup should not preserve INSPECT or FILTER records
	from "postsuper -r". File: pickup/pickup.c.


	Feature: "reject_rbl <domain>" for client address blacklisting
	by LaMont Jones, including $name expansion for per-domain
	customized response messages. The obsolete reject_maps_rbl
	is now a wrapper that uses the new code.


	Internal: added caching and factored out common code that
	will be used for both reject_rbl and for the upcoming
	reject_rhsbl restriction.


	Feature: "reject_rhsbl <domain>" for sender domain
	blacklisting.  Provides the same per-domain customized
	response message mechanisms with $name expansion as

	Safety: the smtpd_expansion_filter parameter controls what
	characters are allowed in the expansion of $name macros in
	template RBL responses.

	Cleanup. In order to make sensible warnings possible when
	expanding a non-existent $name in RBL reply templates,
	mac_expand() had to be changed so that an empty string
	result (i.e. the name does exist) will no longer cause
	${name?text} to succeed.  File:  util/mac_expand.c.


	Cleanup. Renamed the RBL features according to a scheme
	that was suggested by Liviu Daia in October 2001. The names
	are reject_rbl_client and reject_rhsbl_sender, respectively.
	Added domain name based reject_rhsbl_client and
	reject_rhsbl_recipient restrictions for completeness.  The
	reject_rbl restriction name is still recognized for
	compatibility with systems maintained by LaMont Jones.


	Bugfix: reject_rhsbl_<mumble> was broken when <mumble> was
	unavailable, causing the restrictions parser to get out if
	sync. Spotted by Ralf Hildebrandt.  File:  smtpd/smtpd_check.c.


	Bugfix: missing %s in the 20020923 RBL code. This was not
	exploitable because Postfix implements only a safe subset
	of all printf format operators and because memory for the
	result is dynamically allocated.  Victor Duchovni. File:


	Updated MacOSX support scripts from Gerben Wierda.  Files:


	Bugfix: SIZE errors should be reported at MAIL FROM time,
	and should not be postponed (with smtpd_delay_reject = yes)
	until RCPT TO time. Reported by Jeroen Scheerder, Utrecht
	University. Files: smtpd/smtpd.c smtpd/smtpd_check.c.


	When Postfix development started, Linux mail delivery
	software such as procmail did not use kernel locks, and
	Postfix picked one that seemed plausible, namely, flock().
	In the mean time, Linux mail delivery software seems to
	have standardized on fcntl() locks. File: util/sys_defs.h.

	Feature: body_checks_size_limit parameter to specify how
	much of a message body segment (or attachment, if you prefer
	to use that term) is subjected to body_checks inspection.
	Default limit:  50 kbytes. Files:  global/mime_state.c,


	Bugfix: the code for missing postmaster/mailer-daemon
	aliases had to be moved after the code that implements the
	luser_relay feature. Files: local/alias.c, local/unknown.c.

	Weird? The LMTP client lowercased the MAIL FROM and RCPT
	TO addresses. Some remnant of code that someone put in
	there long ago. File: lmtp/lmtp_proto.c.


	Feature: proxy_interfaces parameter. Specify your NAT or
	other proxy addresses here to avoid mail delivery loops.
	Files: global/mail_params.[hc] global/own_inet_addr.[hc]
	global/resolve_local.c smtp/smtp_addr.c smtpd/smtpd_check.c.

	Paranoia: defend against a very unlikely false alarm in


	Feature: X-Original-To: message headers with the raw original
	envelope recipient.

	Logging: status=sent/deferred/bounced/ logging now includes
	the original recipient address if it differs from the final


	Logging: SMTP UCE reject/warn/hold/discard logging now
	includes queue ID. This will break some logfile analyzers.

	Logging: SMTP UCE reject/warn/hold/discard logging now
	includes the protocol name and, if available, the hostname
	given in the SMTP HELO or EHLO command.

	Logging: header/body_checks reject/warn/hold/discard logging
	now includes the protocol name and, if available, the
	hostname given in the SMTP HELO or EHLO command.


	Bugfix: don't reset state after rejected EHLO. Reset state
	after HELO. Reported by Karthikeyan Bhargavan, upenn.edu.
	Files: smtpd/smtpd.c.


	Bugfix: local(8) did not prepend an X-Original-To:  message
	header while delivering to command, and local(8) did not
	document the X-Original-To:  message header.

	Workaround: DJBDNS produces a bogus A record when given a
	numerical hostname. File: dns/dns_lookup.c.


	Portability: support for Berkeley DB version 4.0 but not
	for Berkeley DB version 4.1 (yes, the API is different).
	Postfix is now going to be paranoid about the minor version
	number, too. File:  util/dict_db.c.

	Documentation: updated LMTP_README file by Amos Gouaux.


	Bugfix: (bug introduced 20021026) log NOQUEUE when rejecting
	ETRN, instead of trying to log a non-existent queue ID.
	Victor Duchovni, Morgan Stanley. File: smtpd/smtpd_check.c.

	Cleanup: allow optional text after commands in SMTPD access
	maps. Based on initial effort by Victor Duchovni, Morgan
	Stanley. File: smtpd/smtpd_check.c.

	Portability: support for Berkeley DB version 4.1.  This
	version refuses to open zero-length files. This complicates
	lock management and requires extra code to remove broken
	files. Files:  util/dict_db.c, global/mkmap*.[hc].


	Bugfix: don't complain about out-of-order original recipient
	records for finished recipients. Files:  *qmgr/qmgr_message.c,
	cleanup/cleanup_envelope.c, cleanup/cleanup_extracted.c.

	Cleanup: further simplified the mkmap wrapper (used by
	postmap and postalias only) to remove some hurdles for
	Michael Tokarev's CDB support. Files: global/mkmap*.[hc].


	Postalias now produces YP_LAST_MODIFIED and YP_MASTER_NAME
	records only when NIS support is compiled in. File:


	Postalias now puts $myhostname in the YP_MASTER_NAME record,
	instead of the possibly bogus gethostname() result.  File:

	The PCRE map code did not reject non-numeric replacement
	indices in replacement text, and silently treated $text as
	$0. Found by Michael Tokarev. File: dict_pcre.c.


	Cleanup: the behavior of the SMTP server's defer_if_permit
	flag was changed, in order to maximize the opportunity to
	permanently reject mail without opening opportunities for
	losing legitimate mail. This was done in cooperation with
	Victor Duchovni, Morgan Stanley. File: smtpd/smtpd_check.c.

	The defer_if_permit flag is still set when an UCE reject
	restriction fails due to a temporary (e.g., DNS) problem,
	to prevent unwanted mail from slipping through. However,
	the flag is no longer tested at the end of client, helo or
	sender restrictions.  Instead, the flag is now tested at
	the end of the ETRN and recipient restrictions only.

	The behavior of the warn_if_reject restriction has changed.
	It no longer activates any already made defer_if_permit or
	defer_if_reject decisions (the defer_if_reject flag is set
	when some UCE permit restriction fails due to a temporary
	(DNS) problem, to avoid loss of legitimate mail).

	Bugfix: instead of setting the defer_if_permit flag, a
	failing reject restriction after warn_if_reject now merely
	logs that it would have caused mail to be deferred.

	A failing permit restriction after warn_if_reject still
	raises the defer_if_reject flag, to avoid loss of legitimate


	Bugfix: a misguided change to the .forward macro expansion
	filter broke .forward file lookup.

	Bugfix: missing defer_if_permit test in smtpd_data_restrictions.
	Victor Duchovni. File:  smtpd/smtpd_check.c.


	Robustness: increase the mime_nesting_limit from 20 to 100,
	so that bounces can't loop. Each bounces increases the MIME
	nesting level by one.  Ralf Hildebrandt and Victor Duchovni.


	Robustness: reinstated SMTP client command flushing to
	avoid pipeline stalls.  File: smtp/smtp_chat.c.


	Robustness: distinguish between timeout and "lost connection"
	when the SMTP server is unable to send a reply to the remote
	client. File: smtpd/smtpd_chat.c.


	Bugfix: initialization error with "*" transport table
	lookup, reported by LaMont Jones. The transport map lookup
	code had grown into a monster and needed to be replaced.


	Start implementing recipient verification. For now this is
	done by adding trace flags to queue files. In case of a
	verification request, a delivery agent does not deliver,
	deliver, it just records what would happen.

	This required instrumenting the bounce/defer/sent logging
	routines to send their data to the right place depending
	on the type of delivery request.


	New trace service. This is used for reporting if a recipient
	is deliverable (sendmail -bv) and for producing a record
	of delivery attempts (sendmail -v). The report is sent via
	email, using the bounce daemon. Files: global/trace.[hc].

	This required replacing the bounce/defer logfile format by
	an extensible name=value format. Files: global/bounce_log.c,


	New address verification service with simple expiration
	and refresh policy. Storage can be in-core or in permanent
	table. The daemon is appropriately called "verify". Files:
	global/verify_clnt.[hc], verify/verify.c.


	Cleaning up the code for tracing and verification. Files:


	New address_verification_negative_cache = yes/no parameter
	controls whether Postfix stores the result of negatieve
	address verification probes. This reduces cache pollution
	but causes Postfix to send a probe for each address
	verification service query. File: verify/verify.c.

	Added optimistic caching to the verify daemon, so that one
	failed probe will not clobber a known to be good address.
	As long as some probes succeeed, a good address will stay
	cached as OK.

	Cleaning up of the bounce daemon's code for bounce, delayed
	mail warning and trace notification.  Files: bounce/*.[hc],


	Changed the probe's sender address to "postmaster" so that
	we get better information about the address we're testing.
	File: verify/verify.c.

	Added some paranoia to the routine that reads data from
	the address verification cache. Ignore data that is obviously
	bogus. File: verify/verify.c.


	Bugfix: garbage in "user@garbage"@domain address forms may
	cause the SMTP or LMTP client to terminate with a fatal
	error exit because garbage/tcp is not an existing service.
	This cannot be abused to cause the SMTP or LMTP client to
	send data into unauthorized ports.  Files: *qmgr/qmgr_message.c,


	Bugfix: don't use same VSTRING buffer for reading and
	writing.  File: verify/verify.c.


	Feature: hashed hold queue support, with hashing turned on
	by default. Omission spotted by Victor Duchovni, Morgan
	Stanley. Files: global/hold_message.c, global/mail_params.h.

	Bugfix: the LMTP client lost the port(service) information
	when parsing host:port information. Victor Duchovni, Morgan
	Stanley. Fix is to have a new host_port(3) module that does
	the parsing for the SMTP and LMTP clients.

	Cleanup: host_port() routine that parses host/port information
	more consistently than the existing code in the LMTP and
	SMTP clients. Files: smtp/smtp_connect.c, lmtp/lmtp_connect.c,


	Cleanup: defer mail when recipient verification takes too
	long. File: smtpd/smtpd_proto.c.

	Feature: new reject_multi_recipient_bounce restriction, to
	reject "MAIL FROM: <>" with multiple recipients.  File:


	Compatibility: ignore the new Sendmail -A option. File:

	Workaround: sendmail -v now produces no output. You need
	to specify -v -v instead. This is to avoid problems when
	people request verbose mail delivery in their mail.rc file.
	File:  sendmail/sendmail.c.


	Cleanup: hash_queue_depth now defaults to 1 level of
	subdirectories. This makes "mailq" faster on most systems,
	but will result in poorer worst-case performance when lots
	of mail is queued.

	The check_relay_domains restriction is going away. The SMTP
	server logs a warning and suggests using reject_unauth_destination

	Cleanup: the local(8) and virtual(8) delivery agents did
	not prepend X-Original-To: addresses to maildir files.
	Omission spotted by Matthias Andree.

	Specify "address_verify_sender=" or "address_verify_sender=<>"
	to use a null sender address while doing address verification
	probes.  Beware, doing so may trigger false negatives
	because some sites reject mail from the null sender, even
	though this is required by RFC standards.

	Bugfix: too many levels of dereferencing while testing for
	missing reject_rbl_mumble domain names. Patrik Rak.  File:


	Bugfix: the FILTER access table action included the FILTER
	command in the filter request, where only the transport+destination
	were expected. Noel Jones. File smtpd/smtpd_check.c.

	Cleanup: virtual_maps is now called virtual_alias_maps, in
	order to better distinguish it from virtual_mailbox_maps.
	The default value is $virtual_maps for backwards compatibility.

	New parameters virtual_alias_domains and virtual_mailbox_domains
	for the "domain.tld whatever" lookups.  These use the same
	syntax as the mydestination parameter.  Default settings
	are backwards compatible with Postfix 1.1.

	Concept: just like $mydestination+$inet_interfaces control
	what routes to $local_transport, $virtual_mailbox_domains
	now controls what routes to $virtual_transport (default
	transport:  virtual), and $relay_domains now controls what
	routes to $relay_transport (default transport: relay, a
	clone of the smtp transport).  Everything else routes to
	$default_transport as before.  This eliminates the need
	for transport map entries for every virtual(8) domain, and
	avoids performance problems with inbound relay mail. This
	was improvement was suggested by Victor Duchovni. File:


	Cleanup: do allow regexps in aliases, virtual mailbox maps
	but do not allow regular expression substitutions. Files:
	util/dict.h, util/dict_regexp.c, util/dict_pcre.c.


	Cleanup: deleted the description of sendmail-style virtual
	domains from the virtual(5) manual page. This part of
	Postfix was too confusing.

	Performance: RFC 2821 blesses the use of CNAME domain names
	in MAIL FROM and RCPT TO. Not having to expand CNAME domain
	names speeds things up a bit.  File:  smtp/smtp_proto.c.

	Workaround: exclude error mailer destinations from transport
	mapping lookups :-(. File: trivial-rewrite/resolve.c.

	Cleanup: relocated_maps lookups are now moved to the
	trivial-rewrite server. As of now, the queue manager no
	longer does any map lookups, so it won't restart when maps
	change. Files:  *qmgr/qmgr_message.c, trivial-rewrite/resolve.c.

	Robustness: because the trivial-rewrite server now does
	many more table lookups, some of which are often LDAP or
	SQL based, trivial-rewrite clients must be be prepared for
	the case that the resolver reports a failure while processing
	a request (when it was unable to access a lookup table).
	Files:  trivial-rewrite/resolve.c, local/resolve.c,

	Robustness: moving possible LDAP or SQL table lookups into
	the trivial-rewrite server also required that trivial-rewrite
	be running as multiple processes to reduce lookup latencies.
	Files:  master/multi-server.c.

	Workaround: don't discard all the DNS lookup results when
	only one of the results has a malformed name or address.
	File:  dns/dns_lookup.c.


	Cleanup: with the preliminary address domain classification
	concept as implemented by the trivial-rewrite address
	resolver, a lot of table lookups could be eliminated from
	the SMTP server.  Files: smtpd/smtpd_check.c.

	Feature: new relay_recipient_maps parameter, for optional
	maps with all the recipients in the domains that match
	$relay_domains (so you can reject mail for unknown relay
	recipients). This is for consistency with virtual_xx_maps
	and virtual_xx_domains, and with local_recipient_maps and
	the local delivery agent.  File:  smtpd/smtpd_check.c.

	Cleanup: removed support for obsolete #number domain forms.
	File: smtpd/smtpd_check.c.


	The Postfix installation procedure no longer sets the
	"chattr +S" bit on Linux queue directories. Wietse has
	gotten too annoyed with naive reviewers who complain about
	performance without having a clue of what they are comparing.

	"Security": local_recipient_maps is now turned on by default,
	to reject mail for non-existent users at the SMTP port.
	See conf/main.cf for instructions, section REJECTING UNKNOWN

	Safety: detection of missing or inaccessible passwd file
	database, to prevent massive complaints from people who
	suddenly lose all their mail because local_recipient_maps
	is now turned on by default.


	Feature: recipient address verification, using the code
	that already implements sender address verification.  Based
	on suggestion by Matthias Andree.  Files: src/smtpd/smtpd.c,


	Performance: doubled the default process limit (50->100)
	and default queue manager active queue message/recipient
	limits  (10k->20k).  File:  global/mail_params.h.

	Bugfix: the change that begot us multiple trivial-rewrite
	processes (good) also gave us multiple verify daemons (bad).
	File: conf/post-install.


	Cleanup: allow transport map lookups to override error
	mailer results (to avoid breaking existing installations),
	and do transport map lookups before relocated map lookups.
	Files:  trivial-rewrite/resolve.c, trivial-rewrite/transport.c.

	Shortened the verify server's negative cache refresh time
	from 12 hours to 2 hours. File:  global/mail_params.h.

	Admin friendliness: the SMTP server now reports "User
	unknown in {local recipient | virtual alias | virtual
	mailbox | relay recipient} table". This will make trouble
	shooting a little easier. Files: smtpd/smtpd_check.c,


	Cleanup: transport map entries with null nexthop ignored
	relayhost settings. Making the code simpler also made it
	more correct. Files: trivial-rewrite/resolve.c,

	Feature: "helpful_warnings" (default: yes) that can be
	turned off if you really know what you're doing and want
	to eliminate some unnecessary work.

	Feature: enforcement of master.cf process limits for
	processes such as qmgr and pickup that must run alone, and
	processes such as cleanup and bounce that must run without
	explicit process count limit. If an incorrect process limit
	is specified in master.cf the service aborts.


	Cleanup: it looks like we finally get it right with transport
	lookup table entries that either override or specify an
	error transport without updating the nexthop information.
	File:  trivial-rewrite/resolve.c.

	Robustness: don't probe the sender address when probed for
	our own address verification probe sender address. File:

	Performance: don't do UCE checks (which may result in 4xx
	SMTP reply codes, and thus, repeated delivery attempts)
	when we already know that the recipient does not exist.
	Files:  smtpd/smtpd.c, smtpd/smtpd_check.c.


	Cleanup: further simplification of transport map handling
	after some really fine hair splitting with Victor Duchovni.
	Files: trivial-rewrite/resolve.c, trivial-rewrite/transport.c.


	Workaround:  transform the address local-part into unquoted
	form only when the address domain is local and the local-part
	contains routing operators.  Otherwise, we may damage the
	address local-part by inserting space between non-operator
	tokens. Some people use weird addresses and expect them to
	be handled without damage.  File: trivial-rewrite/resolve.c.

	Robustness: scan the resolved recipient address for routing
	operators in the address local-part, even when the local
	MTA does not recognize ! and % as valid operators.  File:

	Cleanup: the address rewriting code no longer tries to
	rewrite broken user@ or user@. address forms into even more
	broken forms. bother. File: trivial-rewrite/rewrite.c.

	Cleanup: the address resolver code now treates forms ending
	in @ in a more rational manner (because the address rewriting
	code no longer messes up by appending .my.domain).

	Bugfix: a null address local-part before @domain now is
	properly quoted just like the null address. File:


	Cleanup: more work on the trivial-rewrite address rewriting
	and address resolving code. New regression tests for address
	rewriting and resolving that make some assumptions about
	main.cf settings. Files: global/Makefile.in (assumptions),
	global/rewrite_clnt.in, global/rewrite_clnt.ref,
	global/resolve_clnt.in, global/resolve_clnt.ref.

	Safety: configurable SMTPD reject codes for recipients not
	in {local,relay}_recipient,virtual_{alias,mailbox}}_maps,
	aptly named unknown_mumble_reject_code.  Postfix installs
	with unknown_local_recipient_reject_code=450, unless the
	site already ran Postfix with local_recipient_maps enabled.
	Files:  smtpd/smtpd.c, smtpd/smtpd_check.c, conf/post-install.


	Feature: specify unverified_recipient_reject_code=250 or
	unverified_sender_reject_code=250 to accept mail for an
	address that is known to bounce. File: smtpd/smtpd_check.c.


	Bugfix: longjmp() while sending "go away" without setjmp()
	in the QMQP server. Patrik Rak. File: qmqpd/qmqpd.c.

	Safety: the XVERP extension is restricted to clients listed
	in the authorized_verp_clients list (default: $mynetworks).
	File: smtpd/smtpd.c.

	Workaround: preliminary IPV6 support in valid_hostliteral().
	File: util/valid_hostname.c.


	Bugfix: the reject_multi_recipient_bounce restriction had
	an off-by-one error when used in smtpd_data_restrictions.
	File: smtpd/smtpd_check.c.

	Feature: new check_recipient_maps restriction that gives
	finer control over when unknown recipients are rejected.
	As with Postfix 1.1, the default is to do this at the end
	of the recipient restrictions. Sites that want to improve
	performance can put check_recipient_maps at the start of
	the smtpd_client_restrictions list and avoid doing unnecessary
	RBL lookups etc.  File:  smtpd/smtpd_check.c.

	Feature: new show_user_unknown_recipient_table parameter
	controls whether or not to reveal the lookup table name in
	"User unknown" responses. The extra detail makes trouble
	shooting easier but also reveals information that is nobody
	elses business.


	Workaround: don't allow the transport map to override the
	virtual alias class (error:User unknown) result.  File:


	Documentation update: new-style virtual domains broke the
	advanced content filtering example. Files: FILTER_README,


	Cleanup: use different client instances when the same map
	is opened with different flags. File: global/maps.c.

	Feature: proxymap server for Postfix table lookups. This
	helps to consolidate the number of open lookup tables (such
	as MYSQL or LDAP), or to overcome chroot restrictions
	(example: specify proxy:unix:passwd.byname to avoid the
	need for a copy of the UNIX passwd file in chroot jails).
	Files:  global/dict_proxy.[hc], proxymap/proxymap.c

	Cleanup: multiservers such as trivial-rewrite and the new
	proxymap server now enforce the max_use total client number
	limit more agressively, by not accepting new connections
	after the limit is reached.  Based on a patch by Victor
	Duchovni, Morgan Stanley. File:  master/multi_server.c.


	Cleanup: client stream endpoints not only have an idle time
	limit ($ipc_idle) before a connection is closed, they now
	also have a time to live ($ipc_ttl) to prevent connections
	from becoming too persistent. This allows multi-servers
	such as trivial-rewrite or the proxymap server to refresh
	more frequently on busy systems. File:  global/clnt_stream.c.


	Cleanup: avoid warnings about flag mismatches when the same
	lookup table is listed under both virtual_alias_maps and
	virtual_mailbox_maps. Files: global/virtual8.h, virtual/virtual.c.

	Bugfix: an obscure memory leak that puzzled me for more
	than a year until I found out how to reproduce it. File:


	Cleanup: removed the address syntax check from the queue
	manager, since a better test was implemented recently in
	the trivial-rewrite server. Files: *qmgr/qmgr_message.c.

	Bugfix: redirect bounce/defer to the address verification
	service where appropriate. Files: *qmgr/qmgr_bounce.c,

	Bugfix: "no such file or directory" warnings after "postfix
	reload" when a chrooted smtpd reconnects to the proxy
	service.  Fix: use "private/proxymap" if possible, otherwise
	use "$queue_dir/private/proxymap".  File:  global/dict_proxy.c.

	Robustness: daemons now chdir() to the queue directory
	before running the pre-jail initialization code, so that
	daemons running in stand-alone mode produce more consistent
	results.  Files:  master/single_server.c, master/multi_server.c.

	Bugfix: "sendmail -bs" tried to access the proxymap service.
	It should not try to open any user/domain/uce related tables
	at all. File:  smtpd/smtpd.c.


	Bugfix: bouncing to owner-alias was broken, i.e. the mail
	kept being deferred, and when that was fixed, another buglet
	came to light. File: bounce/bounce.c.

	Robustness: the master no longer aborts with "address
	already in use" when inet_interfaces specifies the same IP
	address multiple times, or when a TCP service in master.cf
	specifies a hostname for which the same IP address is listed
	multiple times. File: master/master_ent.c.


	Robustness: check that FILTER actions in SMTPD access maps
	or cleanup header/body_checks have plausible syntax. Files:
	smtpd/smtpd_check.c, cleanup/cleanup_message.c.


	Cleanup: unnecessary "premature end of file on xxx while
	reading yyy" warnings became exposed after some code
	simplification. Files" global/*_clnt.c, global/dict_proxy.c

	Robustness: undo the change that causes a multi-server
	process to stop accepting new connections while it still
	services existing clients for an extended amount of time.
	We need a better process retirement strategy. File:


	Cleanup: the virtual_mailbox_maps parameter is now optional
	even when virtual_mailbox_domains is. This makes virtual
	mailbox domains more like relay domains and the local

	Portability: the makedefs script now uses the pcre-config
	utility to find out where things are installed.

	Bugfix: the SMTP server did not recognize the local built-in
	double bounce address as local. Reported by Matthias Andree.
	For safety sake, threw in the local postmaster address as
	well.  File:  smtpd/smtpd_check.c.


	Added MAILER-DAEMON to the list of always recognized local
	addresses, since it is generated by Postfix bounces. File:


	Bugfix: transport_errno was not reset upon successful
	transport map wildcard lookup after an earlier failure.
	Reported by Victor Duchovni. File:  trivial-rewrite/transport.c.

	Cleanup: unnecessary warnings from the proxymap client
	after proxymap server disconnect. File:  global/dict_proxy.c.

	Cleanup: Patrik Rak found a few more chattr invocations
	that were missed 20021209. Files: postfix-install,

	Cleanup: the pcre-config command can produce null outputs.
	Matthias Andree.  File: makedefs.

	Bugfix: the virtual(8) Makefile included $(AUXLIBS) in the


	Typos: some hyperlinks referred to flushd, which is the
	name that was used before the flush service was released.
	Reported by Victor Duchovni.

	Cleanup: smtpd no longer needed to open relocated_maps.


	Cleanup: bounce messages used "X-Postfix" even when mail_name
	was set to something other than the default "Postfix" name.
	File: bounce/bounce-notify_util.c.


	Bugfix: wrong FILTER_README instructions for disabling
	virtual alias mapping in the cleanup server before the
	content filter.

	Bugfix: wrong FILTER_README instructions for destination-dependent
	filtering, because relay_domains was specified incorrectly.


	Bugfix: 20021207 (move relocated table lookup from queue
	manager to trivial-rewrite server) broke relocated table
	lookup results with mail not rejected at the SMTP port.
	Files:  *qmgr/qmgr_deliver.c, *qmgr/qmgr_message.c.


	Bugfix: a widely used maildir filename algorithm was broken.
	Postfix now uses TIME.DEVICE_INODE.HOST. Files: local/maildir.c,


	Cleanup: queue structures no longer overload queue name
	and nexthop destination. Files: *qmgr/qmgr_message.c,
	*qmgr/qmgr_queue.c, *qmgr/qmgr_deliver.c.


	Feature: "REDIRECT user@domain" action in access maps or
	in header/body_checks causes mail to be sent to the specified
	address instead of the intended recipient(s). I would never
	recommend that people use this to redirect (bounced) SPAM
	to the beneficiaries of an advertisement campaign.  Files:
	smtpd/smtpd_check.c, cleanup/cleanup_message.c,


	Update: maildir filename algorithm updated according to
	today's version of http://cr.yp.to/proto/maildir.html.


	Cleanup: use separate error messages for separate problems
	with computing the list of SASL authentication mechanisms.
	File: smtpd/smtpd_sasl_glue.c.


	Bugfix: allow $name in default time values. File:


	Feature: allow !, /file/name and map:name in masquerade_exceptions.
	By Liviu Daia.  Files:cleanup_init.c, cleanup.h,


	Bugfix: the local pickup daemon skipped unterminated records,
	since they happened to have the same record type code as
	content filtering instructions. Victor Duchovni.  Files:
	global/rec_type.h, pickup/pickup.c.

	Portability: Postfix could block, and thus not enforce
	command execution time limits, while delivering mail to
	command.  File: global/pipe_command.c.

	Bugfix: command execution time limits were not enforced
	because the child process killing code in pipe_command()
	was running with the wrong privileges. Problem reported by
	Ben Rosengart, Panix. File: global/pipe_command.c.

	Bugfix: duplicate recipient filtering in the cleanup server
	did not eliminate virtual expansion duplicates with the
	same original recipient. File: cleanup/cleanup_out_recipient.c.


	Cleanup: added postmap/postalias -p option (do not inherit
	the source file permissions when creating a new file), for
	completeness.  A feature that can't be turned off is a bug.
	Files:  postmap/postmap.c, postalias/postalias.c.

	Bugfix: smtpd_hard/soft_error_limit off-by-one error, so
	that the real limit was one larger than the configured
	value.  File: smtpd/smtpd.c, smtpd/smtpd_chat.c.


	Safety: proxymap server defense against potential deadlock
	when some library routine wants to open a proxied table.
	Instead, proxymap opens the requested table directly. File:

	Portability: updated AIX 5.x system dependent definitions.
	File: util/sys_defs.h.


	Bugfix: added mynetworks to the list of proxy_read_maps
	parameter settings that are pre-authorized to use proxied
	table lookups.  File: global/mail_params.h.

	Cleanup: daemons now log what table has changed before
	restarting. Files: dict.c, and anything that invoked

	Cleanup: more consistency in the naming of lookup table
	handles as generated by maps(3) and by match_list(3).


	Workaround: Postfix removes too long non-address text from
	message headers in order to protect vulnerable Sendmail
	systems against exploitation of the remote buffer overflow
	vulnerability described in CERT advisory CA-2003-07.


	Bugfix: the access map actions HOLD, DISCARD, FILTER and
	REDIRECT were broken with smtpd_delay_reject=no and with
	ETRN.  This required re-architecting of the actions code.
	Files:  smtpd/smtpd.[hc], smtpd/smtpd_check.c, smtpd/smtpd_state.c.


	Bugfix: the postsuper manual page documented support for
	the -c command line option, but it was not implemented.
	File: postsuper/postsuper.c.

	Bugfix: the Postfix 2.0 recipient map checking code broke
	the VRFY command, causing it to reply with status code 252
	for non-existent addresses. This required re-architecting
	the recipient table lookup code. File:  smtpd/smtpd_check.c.


	Feature: configurable limit on virtual alias expansion size
	and nesting depth, via the virtual_alias_expansion_limit
	and virtual_alias_recursion_limit parameters. The default
	limits are compatible with past Postfix versions.  Victor
	Duchovni, Morgan Stanley. Files: /sample-resource.cf,
	html/resource.html, cleanup/cleanup.c, cleanup/cleanup_init.c,

	Feature: the installation procedure records build information
	(by default:  in /etc/postfix/makedefs.out).


	Bugfix: smtp-source flushed too often, causing suboptimal
	performance with smtp-source sending directly into smtp-sink.
	Files: smtpstone/smtp-source.c.


	Safety: log a fatal error when a net/mask pattern has a
	non-zero host part, so that mail delivery is deferred.
	File: util/match_ops.c.


	Bugfix: extraneous warning about out-of-order original
	recipient records by Patrik Rak. Files: *qmgr/qmgr_message.c.


	Workaround: log a warning and reset the queue file time
	stamps when the file system clock is ahead of the local
	clock.  File: global/mail_stream.c.


	Feature: PostgreSQL client module, adopted by LaMont Jones.
	Files: README_FILES/PGSQL_README, util/dict_pgsql.c,
	util/dict_pgsql.h, conf/sample-pgsql-aliases.cf.

	Cleanup: the generic smtp client/server code in smtp_stream.c
	now has an explicit flush operation, and the smtp-source/sink
	programs are updated to take advantage of this.

	Cleanup: the file system clock drift detection code now
	runs only once per process instance, to minimize the
	performance impact. File: global/mail_stream.c.

	Robustness: avoid TIME_WAIT state with smtp/qmqp-source
	client sockets.  This puts less strain on local system


	Cleanup: the file system clock drift detection code now
	runs only for incoming mail. File: global/mail_stream.c.


	Bugfix: missing partial last line when 1) someone submits
	8-bit mail not ending in newline via /usr/sbin/sendmail
	and 2) MIME input processing is turned off, and 3) MIME
	8bit->7bit conversion is requested upon delivery via SMTP.

	Cleanup: auto-bcc recipients are now added in one place
	(the cleanup server) instead of by individual front-end
	servers (pickup, smtpd, qmqpd). This makes it easier to
	add auto-bcc features that trigger on sender or recipient

	Cleanup: "sendmail -t" (recipients from headers) is now
	implemented by the sendmail command instead of by the
	cleanup server. This means that the extract_recipient_limit
	configuration parameter is no longer needed.  Files:
	sendmail/sendmail.c, cleanup/cleanup_message.c,

	Compatibility: "sendmail -t" (recipients from headers) now
	accepts command-line recipients instead of complaining.
	The extracted header recipients are added to the command-line

	Feature: sender/recipient_bcc_maps. These are indexed by
	sender/recipient address and are examined when mail enters
	from outside of Postfix. Files: cleanup/cleanup_addr.c.
	cleanup/cleanup_envelope.c cleanup/cleanup_extracted.c.


	Feature: the SMTP client now falls back to native name
	service lookups (including /etc/hosts) when a host cannot
	be found in the DNS. This is controlled by a new parameter
	smtp_host_lookup (default: dns, native). Files: smtp/smtp.c,


	Bugfix: "sendmail -t" broke with unrecognized message


	Feature: "postcat -q" searches the queue for the named

	Cleanup: made postcat "record names" output more consistent.


	Debugging: added some extra detailed error logging to the
	pipe-to-command delivery, to help folks with bizarre file
	truncation problems. File: global/pipe_command.c.


	Cleanup: readlline() did not terminate the result before
	complaining about lines starting with whitespace.

	Cleanup: eliminated valid_hostname warning for invalid
	queue file names. File: global/mail_queue.c.

	Bugfix: lost three lines of code when readying the postcat
	command for release, which broke postcat -q. File:

	Bugfix: the Postfix sendmail command applied the message
	size limit when running as newaliases. The limiting code
	is now moved to the message enqueuing branch of the code.
	File: sendmail/sendmail.c.

	Documentation: start of documentation for the algorithm of
	Patrik Rak's clever queue manager scheduler (nqmgr). Files:
	conf/sample-scheduler.cf, README_FILES/SCHEDULER_README.


	Bugfix: while verifying an address, the LMTP client entered
	a forbidden "next" sender state after the last recipient.
	Fix by Vladimir Davydoff. File: lmtp/lmtp_proto.c.

	Bugfix: "," was not recognized in proxy_read_maps settings.
	Fix by Leandro Santi. File: proxymap/proxymap.c.


	Bugfix: defer delivery after .forward etc. file read error.
	File: local/token.c. Problem reported by Ben Rosengart,


	Bugfix: the Postfix LMTP client used the wrong service
	name, causing trouble with SASL 2.1.13.  Daniel Schales,
	Louisiana Tech. File: lmtp/lmtp_sasl_glue.c.


	Workaround: IRIX select() reports that a non-blocking file
	descriptor is writable while write() transfers zero bytes.
	File:  util/vstream.c. Superseded by change 20030523.


	Cleanup: future time stamps in Received: headers and negative
	delays in delivery agent logging after "postdrop -r",
	because deferred queue files had future file modification
	times.  File:  src/postsuper/postsuper.c.


	Cleanup: nqmgr warnings about "recipient count mismatch"
	after "postdrop -r", because the cleanup server did not
	count the "already done" recipients. Problem reported by
	Richard Stockton, Gramma Software. Files:
	cleanup/cleanup_envelope.c, cleanup/cleanup_extracted.c.


	Workaround: IRIX select() reports that a non-blocking file
	descriptor is writable while write() transfers zero bytes.
	File:  global/pipe_command.c.


	Cleanup: rewrote the queue file record processing loops in
	pickup, cleanup and in [n]qmgr. This code had deteriorated
	a lot as the result of small changes over the years. This
	change brings the code closer to "obviously correct". Files:
	cleanup/cleanup_envelope.c, cleanup/cleanup_extracted.c,

	Cleanup: Postfix no longer produces queue files with
	backwards compatibility data for Postfix versions < 1.0
	(a.k.a.  20010228). Files: cleanup/cleanup_extracted.c,

	Performance: the queue manager no longer has to examine
	every queue file record before it can start deliveries.
	This helps to avoid thrashing with very large mailing lists.
	Postfix queue files have an extra field in the size record
	with queue manager processing hints.  This change is backward
	and forward compatible.  Files:  cleanup/cleanup_envelope.c,
	cleanup/cleanup_extracted.c, *qmgr/qmgr_message.c.


	Compatibility: "sendmail -q<time>" without -bd option now
	exits immediately, instead of waiting for input on the
	standard input stream and screwing up system boot sequences.
	File: sendmail/sendmail.c.


	Bugfix: client access denied with smtpd_delay_reject=no
	broke "sendmail -bs". Fix by Victor Duchovni, Morgan Stanley.
	File: smtpd/smtpd.c.


	Compatibility: allow <@site,@site:address> route addresses
	in SMTP commands.  File: smtpd/smtpd.c.


	Cleanup: input checks moved from the pickup daemon to the
	postdrop mail submission command; this is to prepare for
	direct mail submission from postdrop->cleanup without going
	through the maildrop directory and the pickup service.
	Files: pickup/pickup.c, postdrop/postdrop.c.

	Bugfix: the "dead host" backoff timer in the MySQL client
	didn't work.  Fix by Leandro Santi. File: util/dict_mysql.c.

	Bugfix: same problem in the PostgreSQL client. File:

	Workaround: turned off non-blocking write to pipe because
	too many systems give a weird write() result. File:

	Cleanup: added support for vstream_fseek(.., .., SEEK_END).
	File: util/vstream.c.


	Feature: separate address resolver controls for address
	verification probe messages:  address_verify_{local,virtual,
	relay,default}_transport, address_verify_relayhost, and
	address_verify_transport_maps. The default values are the
	regular versions of the same controls. Files: trivial-rewrite/*,
	global/resolve_clnt.[hc], *qmgr/qmgr_message.c.


	Workaround: Solaris blocking socket read() may hang.  Hernan
	Perez Masci and Leandro Santi. File: smtpd/smtpd.c.

	Bugfix: the "unread recipient" counter needs to be restored
	after the queue manager has a problem reading a queue file.
	Fix by Patrik Rak. File: nqmgr/qmgr_message.c.


	Cleanup: the verify server now uses asynchronous submission
	of mail probes, so it will no longer block for in_flow_delay
	seconds when mail arrives faster than it is delivered.
	Still need to make mail_stream_finish() asynchronous in
	order to avoid blocking for trigger_timeout seconds when
	the queue manager is overwhelmed.  Files:  global/post_mail.c,

	Bugfix: removed extraneous sleep() after the last attempt
	to retrieve address verification status.  File: smtpd/smtpd.c.


	Bugfix: the stricter postdrop input filter broke "sendmail
	-bs". Found by Lutz Jaenicke. File: smtpd/smtpd.c.


	Portability: Dropped support for client side LDAP caching.
	As of release 2.1.13 OpenLDAP no longer supports client
	side caching, it has been deprecated for some time, and
	never worked well.  Implemented by Victor Duchovni, Morgan
	Stanley, and further enhanced by Lamont Jones, HP. Files:
	src/util/dict_ldap.c, conf/sample-ldap.cf,

	Safety: Given suitable invalid database contents, LDAP
	lookups can produce too many results, enter an infinite
	loop in the expansion of "special result attributes" (LDAP
	DNs and LDAP URLs) or just consume excessive server resources
	returning large result sets.  Three new (per LDAP map)
	configuration parameters enable one to set limits on
	recursive nesting, result expansion and the server response
	"entry" count. Implemented by Victor Duchovni, Morgan
	Stanley, further enanced by Lamont Jones, HP. Files:
	src/util/dict_ldap.c, conf/sample-ldap.cf,


	Feature: in mail delivery status reports, report the sender
	address as X-Postfix-Sender. Matthias Andree. File:

	Cleanup: in mail delivery status reports, transform the
	original recipient into xtext format as required by RFC
	1891. Files: bounce/bounce_notify_util.c, util/xtext.[hc].

	Cleanup: more accurate "postfix check" warning for files
	that miss one or more of the required mode 02111 execute
	permission bits. Matthias Andree. File: conf/postfix-script.


	After "postfix reload", the master daemon now warns when
	inet_interfaces has changed, and ignores the change, instead
	of passing incorrect information to the smtp server. File:


	Feature: the Postfix SMTP server can send all mail into a
	proxy server, for example a real-time SPAM filter. This
	proxy is supposed to send the mail into another Postfix
	SMTP server process for normal delivery. Files: smtpd/smtpd.c


	Bugfix: a cut-and-paste error caused the proxy server's
	354 status code to be reported when a proxy connection
	broke during the DATA phase. File: smtpd.c.


	Bugfix: after the last change to postdrop, postcat no longer
	recognized maildrop files as valid. File: postcat/postcat.c.

	Bugfix: after moving "sendmail -t" address extraction to
	sendmail, "-t" broke multi-line recipient headers.  Victor
	Duchovni, Morgan Stanley. File: sendmail/sendmail.c.


	Workaround: the safe_open(O_CREAT) race condition exploit
	avoiding code tries a little harder when it encounters a
	race condition. File: util/safe_open.c.


	Bugfix: reject_unverified_address() set the defer_if_reject
	flag when the verify service was unavailable (which never
	happens). Victor Duchovni, Morgan Stanley. File:

	New parameters address_verify_poll_{count,delay} that
	control how often to poll the address verification service
	for the completion of an address verification request.
	Specify address_verify_poll_count=1 to implement a crude
	form of greylisting, that is, always defer the first delivery
	attempt for an unknown address.  File: smtpd/smtpd_check.c.

	Bugfix: after the last change to postdrop, postcat no longer
	recognized non-maildrop queue files as valid. File:


	Cleanup: replaced references to "simulated virtual domains"
	by "virtual alias domains". Victor Duchovni, Morgan Stanley.


	Feature: smtp_quote_rfc821_envelope=(yes|no) to control
	RFC 821 style quoting of MAIL FROM and RCPT TO addresses.
	Files: global/mail_params.h, smtp/smtp.c, smtp/smtp_proto.c.


	Bugfix: multi-recipient probes triggered a bug in the SMTP
	client.  File: smtp/smtp_proto.c.

	Feature: enable_original_recipient (default: yes) to control
	whether Postfix keeps track of original recipient address
	information. Victor Duchovni, Morgan Stanley.  Files:
	cleanup/cleanup.c, cleanup/cleanup_init.c,
	cleanup/cleanup_out_recipient.c, global/log_adhoc.c,
	global/mail_copy.c, *qmgr/qmgr_message.c.

	Feature: !/pattern/ support for PCRE lookup tables.  Victor
	Duchovni, Morgan Stanley.  Files: util/dict_pcre.c.

	Cleanup: allow whitespace after patterns in repexp and pcre
	tables. Victor Duchovni, Morgan Stanley.  Files:
	util/dict_pcre.c, util/dict_regexp.c.


	Feature: CIDR lookup table support, very remotely based on
	code by Jozsef Kadlecsik. Files: proto/cidr_table,

	Feature: TCP lookup table support, finally finished.  Files:
	proto/tcp_table, proto/dict_tcp.[hc].


	Feature: new receive_override_options parameter controls
	what happens before or after an external content filter:
	rejecting unknown recipients, canonical and virtual address
	mapping, address masquerading, automatic BCC recipients
	and header/body checks. This eliminates the need to configure
	multiple cleanup services in the master.cf file.


	Feature: context dependent SASL security options (i.e.
	different options when TLS is enabled/disabled). Lutz
	Jaenicke.  Files:  */*sasl_glue.[hc].


	Hardened the attr_scan routines for exposure to an untrusted
	environment, in preparation for possible use with SMTP
	policy delegation to an external server.

	Feature: address filter for RBL lookups, for use with
	multi-valued RBL services. File: smtpd/smtpd_check.c.


	Cleanup: use off_t instead of int for VSTREAM file offsets.
	This was needed for mailboxes > 2GB on 32-bit systems.
	Files: util/vstream.c, global/mail_copy.c.


	Support for multiple A and TXT results in RBL lookups.
	Victor Duchovni, Morgan Stanley.  File: smtpd/smtpd_check.c.

	Support for attribute-based query-reply protocols.  Files:
	util/attr_clnt.[hc], util/auto_clnt.[hc].


	Support for plain "name=value\n" attribute protocol.  Files:

	Bugfix: the LMTP session caching code did not reset the
	EHLO server feature list when it needed to reconnect.
	Problem found by Tobias Erbsland.


	Feature: delegated SMTP policy server. As an example, see
	the greylisting server in examples/smtpd-policy.  Specify
	"check_smtpd_policy_service" in smtpd_mumble_restrictions.


	Bugfix: in the sample policy server, changed "ok" into
	"dunno" so the server can be used in the middle of a
	restriction list.

	Cleanup: when an RBL reply has multiple TXT records,
	concatenate them up to some reasonable limit, instead of
	selecting one randomly.  File:  smtpd/smtpd_check.c.

	Safety: always truncate SMTP server error replies to 512
	bytes.  File: smtpd/smtpd_check.c.


	Documentation: added description of policy_time_limit to
	the SMTPD_POLICY_README document.

	Documentation: corrected the command time limit parameter
	syntax in the spawn(8) manual page.

	Feature: defer_if_permit and defer_if_reject actions in
	access tables, mainly for use by the delegated policy
	server. Files: smtpd/smtpd_check.c, proto/access.


	The dict_pgsql module did not use dict_alloc() and dict_free(),
	causing improper initialization and a memory leak. Leandro
	Santi. File: util/dict_pgsql.c.

	Cleanup: added open_flags sanity checks to the dict_pgsql
	and dict_mysql modules. These maps must be opened in
	read-only mode.


	Bugfix: virtual(8) was changed to use mail_addr_find()
	instead of virtual8_maps_find(), but the SMTP server's
	virtual mailbox recipient validation was not updated.


	Bugfix: the 20030712 safety against invalid DNS results
	was broken. Reported by Ralf Hildebrandt. File:


	Safety: the pipe daemon now defers delivery with a warning
	when it is given a non-existent command-line macro name.
	File:  pipe/pipe.c.


	Bugfix: dict_ldap had a few harmless memory leaks.  By
	Liviu Daia.  File: util/dict_ldap.c.

	Feature: support for LDAP URLs in the LDAP parameter
	"server_host", if Postfix is linked against OpenLDAP.  This
	allows Postfix to connect to LDAP SSL sources.  By Liviu
	Daia.  File: util/dict_ldap.c.


	Cleanup: produce a warning when host:port specifies a badly
	formatted numerical port.  Files:  util/find_inet.c,
	smtp/smtp_connect.c, lmtp/lmtp_connect.c.


	Feature: the export_environment and import_environment
	parameters now accept name=value information that will be
	entered into the new environment. File: util/clean_env.c.


	Feature: smtpd_sasl_exceptions_networks parameter to prevent
	Postfix from offering AUTH  to clients that match the listed
	networks. Based on code by Ben Rosengart, Panix. Files:
	conf/sample-auth.cf, smtpd/smtpd.c.


	Portability: the Postfix master resets the file size to
	the largest possible off_t value when the actual limit
	appears to overflow the off_t range. Files: util/sys_defs.h,
	util/file_limit.c. A fine sample of bit banging.


	Workaround: Solaris 8 select() claims that a non-blocking
	socket is readable and then read() fails with EAGAIN. Files:
	util/timed_read.c and as precautionary measure,

	Bugfix: dict_register() should not be called from dict_open()
	in dict_mysql and dict_pgsql.  Liviu Daia.  Files:
	util/dict_mysql.c, util/dict_pgsql.c.

	Feature: LDAP parameters can now be specified in external
	files.  This makes it possible to securely store bind
	passwords for plain auth outside of main.cf (which is world
	readable).  By Liviu Daia, based on a suggestion by Victor
	Duchovni and Lamont Jones.  File: util/dict_ldap.c.

	Feature: STARTTLS option for LDAP, if Postfix is linked
	against OpenLDAP.  By Liviu Daia, amended by Victor Duchovni.
	File:  util/dict_ldap.c.

	Cleanup: connections to LDAP sources are now postponed
	until they are actually needed.  By Liviu Daia.  File:


	The 20030905 Solaris workaround triggers too many warnings.
	TCP sockets are back to blocking, and keepalives are turned
	on to kill off dead sockets, as suggested by Leandro Santi.
	Files: master/{single,multi}_server.c, smtpd/smtpd.c,


	Bugfix: the LMTP session caching code had problems with
	SASL authentication after the first connection, and pipelining
	was working poorly.  Fix by Victor Duchovni, Morgan Stanley.
	Files: lmtp/lmtp.c, lmtp/lmtp_proto.c.


	Workaround: besides SMTP server sockets, SMTP client sockets
	can also hang on Solaris, as reported by Leandro Santi. In
	order to deal with this at the root, all connection management
	is now done by sane_accept() and sane_connect().  Both turn
	on keepalives on Solaris.


	Safety: set-gid commands don't trust TZ.  File: msg_syslog.c.


	Address extension propagation wasn't documented enough when
	it was added to Postfix. Based on patches by Roman Neuhauser.

	Added clarifying notes to main.cf, master.cf and access by
	Dean Gibson.

	In header/body_checks, DUNNO is now the preferred action
	instead of the now deprecated OK. This may confuse fewer

	In header/body_checks, allow text after IGNORE and DUNNO,
	suggested by Victor Duchovni, Morgan Stanley.  File:

	Feature: reject_rhsbl_helo. File: smtpd/smtpd_check.c.

	Bugfix? The LMTP and SMTP clients now send "MAIL FROM:<sender>
	AUTH=<>" when SASL authenticated. Suggested by by Victor
	Duchovni, Morgan Stanley. Files: smtp/smtp_proto.c,


	Bugfix: mail rejected by the before-queue content filter
	was mis-labeled as a software error; it should be labeled
	as a policy error instead. File: smtpd/smtpd.c.

	Cleanup: postcat is now null-byte transparent. File:


	Feature: ``check_{sender,recipient}_mx_access maptype:mapname''
	applies the named Postfix access table to the MX host name
	and IP addresses for the sender or recipient address. If
	no MX record is found, the A record is used instead. File:

	Feature: ``check_{sender,recipient}_ns_access maptype:mapname''
	applies the named Postfix access table to the DNS server
	hostname and IP addresses for the sender or recipient
	address. If no NS record is found, the parent domain is
	used instead. File: smtpd/smtpd_check.c.


	Feature: ``check_helo_{ns,mx}_access maptype:mapname'',
	same semantics as sender and recipient.

	Multiple LDAP lookup tables in the one Postfix process now
	share one LDAP connection. Code by Victor Duchovni, Morgan
	Stanley.  File: util/dict_ldap.c.

	Performance: with prefix_domain specified for an LDAP lookup
	table, lookups of @domain are skipped. Code by Victor
	Duchovni, Morgan Stanley.  File: util/dict_ldap.c.

	Safety: check_mumble_{mx,ns}_access refuses to be used for
	whitelisting. The Postfix SMTP server will reject the
	request with "451 server configuration error" and will log
	a warning explaining why. File: smtpd/smtpd_check.c.


	Bugfix: check_mumble_ns_access did not correctly look up
	NS records of parent domains, causing mail to be deferred
	with a 450 status code. File: smtpd/smtpd_check.c.


	Robustness: check_mumble_{mx,ns}_access skip over DNS lookup
	failures instead of deferring mail. This is not as bad as
	it appears to be because the restrictions can't be used
	for whitelisting.  File: smtpd/smtpd_check.c.


	Bugfix: the 20030917 LDAP connection sharing code introduced
	a compilation problem with non-OpenLDAP implementations.
	Fix by Liviu Daia. File: util/dict_ldap.c

	Compatibility: the LDAP server_host parameter now supports
	all the usual Postfix list element delimiters. Some LDAP
	libraries support just SPACE, others SPACE and ",". Postfix
	now normalizes the host list into a space separated format.
	This is less surprising to Postfix users used to the full
	range of delimeters in other contexts. Implemented by Liviu
	Daia. File: util/dict_ldap.c

	Bugfix: after returning too old mail, the bounce daemon
	now locks the original queue file and deletes deferred
	recipients, to avoid repeated bounce notifications when
	the queue manager is restarted. Files:  bounce/*.[hc],
	global/bounce_log.[hc], global/{bounce,defer}.[hc] and
	everything that invokes these routines including queue
	manager and delivery agents.


	Feature: "XADDR address hostname" SMTP command, for SMTPD
	restriction debugging, and for sites with fetchmail-like
	software that extracts client information from the first
	Received:  header. The smtpd_authorized_xaddr_clients
	parameter specifies what clients are allowed to use XADDR
	(default: none).  Files:  smtpd/smtpd.c.


	Workaround: smtpd access maps should not apply subdomain
	name magic to numerical hostnames. File: smtpd/smtpd_check.c.

	Safety: the local delivery agent now defers delivery when
	alias lookup produces an empty result. File: local/alias.c.


	Workaround: disable request/reply size limit in attr_scan*.c
	to prevent mail from getting stuck when rewriting a malformed
	message header.  This limit was turned on with snapshot
	20030715 to harden the protocol that is used by SMTPD policy
	delegation. A "no code change" workaround is to specify
	"header_size_limit = $line_length_limit".  The proper fix
	is to enforce request/reply size limits only for data from
	outside of Postfix. Problem reported by Brandon Mullenberg,
	Dialup USA. Files:  util/attr_scan*.c.

	Feature: "XLOGINFO address hostname" SMTP command, so that
	Postfix daemons behind SMTPD pass-through proxies log useful
	client name/address information instead of localhost[].
	The smtpd_authorized_xloginfo_clients parameter specifies
	what clients are allowed to use XLOGINFO (default: none).
	Files:  smtpd/smtpd.c.

	Cleanup: renamed the authorized_verp_clients parameter to
	smtpd_authorized_verp_clients for consistency.


	Workaround: the demo greylist script now uses BTREE instead
	of HASH files for hopefully better stability. The real fix
	is to use a single updater process that serves multiple
	clients. That approach seems to work well with the verify
	daemon. File: examples/smtpd-policy/smtpd-policy.pl.


	Safety: the SMTP server now warns when the queue_minfree
	value is less than twice the message size limit. File:

	Safety:  the SMTP server no longer accepts mail when the
	amount of free space is less than twice the message size
	limit.  File: smtpd/smtpd_check.c.

	Safety: log a warning and defer mail when canonical or
	virtual lookups return a non-address result (like a string
	that contains no address). File: global/mail_addr_map.c.

	Safety: log a warning and defer mail when any map lookup
	returns an empty string result, and explain that "no result"
	is expected in case of a "not found" condition. This happens
	with incorrectly implemented SQL or LDAP tables. File:


	Bugfix: the MYSQL and PGSQL modules invoked dict_register().
	This was fixed a while ago but never made it into the
	distribution. Files: util/dict*sql.c.

	Robustness: added three ISSPACE() calls in the smtpd proxy
	parser. File: smtpd/smtpd_proxy.c.


	Portability: added localhost to mydestination for sites
	that turn off append_dot_mydomain. File: global/mail_params.h.


	Portability: MacOS X Bind8 compatibility. File: makedefs.


	Robustness: flush pipelined "." and "quit" replies to avoid
	repeated deliveries in case of a program crash (you know,
	the kind of thing that happens before Postfix release :-).
	File:  smtpd/smtpd.c.


	Portability: turn off NETINFO support for MacOS X Panther
	by default. Files: makedefs, util/sys_defs.h.


	Feature: the sample greylist policy server is now case
	insensitive.  File: examples/smtpd-policy/smtpd-policy.pl.


	Feature: preliminary defense against SMTP clients that
	hammer the SMTP server with too many simultaneous or
	successive connection attempts, with a whitelist capability
	to disable the restriction for authorized clients.  Most
	work is implemented by a new "anvil" server.  Parameters:
	smtpd_client_connection_count_limit, smtpd_client_connection-
	_rate_limit, smtpd_client_connection_limit_exceptions, and
	client_connection_rate_time_unit.  Documentation:  smtpd(8),
	anvil(8), sample-smtpd.cf. Files:  smtpd/smtpd.c,
	global/anvil_clnt.[hc], anvil/anvil.c.  The anvil server
	logs peak count and rate information per client when it
	terminates after running out of work or after "postfix


	Cleanup: Postfix now supports the /0 netmask (match every
	address).  This is useful as a catch-all pattern at the
	end of a table.  Files:  util/dict_cidr.c, util/match_ops.c.

	Cleanup: don't report that $queue_directory/etc/filename
	differs from /etc/filename when /etc/filename does not
	exist.  File: conf/postfix-script.


	Feature: client_connection_status_update_time parameter
	controls periodic logging of maximal connection counts or
	rates.  The default logging interval is 10 minutes.

	Feature: "make makefiles WARN=stuff..." overrides the
	built-in GCC warning options that are used when "make" is
	invoked from within a source subdirectory. Files:  makedefs,


	Feature: qmgr logs "queueid: deleted", just like postsuper,
	when it removes a message from the mail queue.

	Performance: smtpd connects to the cleanup or proxy server
	AFTER the first valid RCPT TO command, instead of after
	the first valid MAIL FROM command. This avoid wasting
	real-time proxy filter resources when mail is stopped by
	the SMTP server's access blocks.  File: smtpd/smtpd.c.


	Bugfix: "panic: mymalloc: requested length 0" when master.cf
	specified an invalid host name or address.  Postfix now
	logs more specific information. File:  master/master_ent.c.
	Reported by several people.


	Feature: XCLIENT support to override the SMTP server's
	client information for logging and/or access control. This
	replaces the short-lived XADDR and XLOGINFO extensions.
	Remotely based on code by Victor Duchovni.  See FILTER_README
	and SMTPD_PROXY_README for usage details. Files:
	smtp/smtp_smtp_proto.c, *qmgr/qmgr_message.c,


	Cleanup: postfix-files now has support for files that are
	no longer part of Postfix. When upgrading Postfix, the
	post-install script gives the user a reminder. Files:
	conf/postfix-files, conf/post-install.


	Support for SMTPD access map actions (FILTER, REDIRECT,
	HOLD or DISCARD) that are delegated to the cleanup server,
	but can trigger before the first valid recipient address
	is accepted (and thus, before a cleanup server connection
	is available).  Files:  smtpd/{smtpd,smtpd_state,smtpd_check}.c.


	Bugfix: conf/post-install didn't skip non-existent obsolete
	files.  Victor Duchovni.

	Minor cleanups of the xclient error messages; xclient
	command lookup tables. File: smtpd/smtpd.c.


	Feature: reject_sender_login_mismatch allows multiple owners
	of a sender address.  Code by Liviu Daia.  Files:
	smtpd/smtpd_check.c and documentation.

	reject_sender_login_mismatch is now implemented by elementary
	features reject_unauthenticated_sender_login_mismatch
	(reject if the client is not SASL logged in but the sender
	address has an owner in smtpd_sender_login_maps) and
	reject_authenticated_sender_login_mismatch (reject if the
	client is SASL logged in but does not own the sender
	address).  Code by Liviu Daia.  Files: smtpd/smtpd_check.c
	and documentation.


	Bugfix: fallback_transport and mailbox_transport were broken
	because the deliver_pass.c module was not updated for the
	changed message delivery protocol.


	Safety: in dynamically growing data structures, update the
	length info after (instead of before) updating the data
	size. Files:  util/argv.c, util/inet_addrlist.c, util/intv.c,
	util/mvect.c, util/vstring.c, global/recipient_list.c,


	Cleanup: separate extensions XCLIENT (impersonate SMTP
	client) and XFORWARD (down-stream logging of up-stream MTA
	and/or message information, not necessarily SMTP related).
	The protocol is extensible: the server advertises what
	attributes XCLIENT or XFORWARD will accept, and it is an
	error to send an unsupported attribute.  No xtext encoding
	is used, since no attribute currently needs it.  See also:


	Feature: XFORWARD support in the LMTP client.


	Safety: updated mail_queue_id_ok() for long fast flush
	logfile names. File: global/mail_queue.c.

	Robustness: save and restore the resolver _res.options
	settings before and after DNS lookup, to avoid surprises
	in third-party code. This may eliminate some "localhost
	not found" problems. File: dns/dns_lookup.c.


	Cleanup:  easier to parse mailq output (no more space
	between short queue ID and message status).  File:


	Cleanup: the SMTP client now moves on to the next MX host
	or fallback relay when delivery fails in the middle of an
	SMTP session. This includes both broken connections and
	4xx SMTP server replies.  Files:  smtp/smtp.c, smtp_rcpt.c,
	smtp/smtp_connect.c, smtp_trouble.c.

	Configuration parameters: smtp_mx_address_limit (limit the
	list of IP addresses from MX lookup), and smtp_mx_session_limit
	(limit the number of actual SMTP sessions per delivery
	attempt, ignoring unusable MX IP addresses).

	The new code centers around a mark-and-sweep algorithm
	(replacing code that twiddled the rcpt->offset structure
	member), with paranoid sanity checks to ensure that every
	recipient is explicitly accounted for.


	Update: LDAP client logging (Liviu Daia) and LDAP client
	documentation (Victor Duchovni). Files: util/dict_ldap.c,
	conf/sample-ldap.cf, README_FILES/LDAP_README.


	Cleanup: shaved half the worst-case bits off the cleanup
	duplicate address filter footprint. After discussion with
	Victor Duchovni. File: cleanup/cleanup_out_recipient.c.

	Safety: added "mail loops to myself" logic for destinations
	that don't have an MX host.  File: smtp/smtp_addr.c.


	Workaround: turn off "mail loops to myself" for non-MX
	destinations because it breaks SMTP-based content filters.
	Fix is to turn off loop detection when a non-default TCP
	port is specified.  File: smtp/smtp_addr.c.

	Bugfix: restore errno after write failure in SIGCHLD handler.
	Leandro Santi (who got the idea from Hernan Perez Masci).
	File: master/master_sig.c.

	Bugfix: the auto_clnt module disconnected too early, causing
	unnecessary work by the anvil server.

	Cleanup: eliminated binary hashes from anvil server. Anvil
	client information is now stored on top of its VSTREAM.


	Feature: bounce_queue_lifetime parameter (default:
	$maximal_queue_life_time) that bounds the time that
	MAILER-DAEMON messages spend in the queue before they are
	considered undeliverable.

	Feature: disable "mail loops back to myself" protection
	when SMTP mail is sent to a non-standard port. This makes
	setting up content filters less painful.

	Cleanup: disallow bare x.x.x.x numeric IP addresses in
	email addresses. The form user@[x.x.x.x] is still allowed.

	Cleanup: cleaned up the naming of internal symbols in the
	SMTP client.


	Bugfix: stricter address syntax test broke "sendmail -bs".
	File: smtpd/smtpd.c.


	Cleanup: the Postfix SMTP server rejects a MAIL FROM address
	that matches a local, virtual or relay domain, while the
	address is not listed in the corresponding local, virtual
	or relay recipient table.

	Feature: the reject_unlisted_sender(recipient) SMTPD access
	restriction rejects an address that matches a local, virtual
	or relay domain, while the address is not listed in the
	corresponding local, virtual or relay recipient table.

	Compatibility: the check_recipient_maps restriction works
	like reject_unlisted_recipient, but will eventually be
	removed from Postfix.


	Misc documentation cleanup by Loic Minier.


	Workaround: MacOSX dumps core on the 20030913 TZ censoring
	code. We explictly set TZ=UTC, which will produce incorrect
	results when "mailq" formatting is moved from the showq
	daemon to the postqueue command.   File: msg_syslog.c.

	Feature: after mail is requeued with "postsuper -r", the
	pickup server logs the old queue ID together with the new
	queue ID.  Victor Duchovni. File: pickup/pickup.c.

	Feature: smtpd_sasl_application_name parameter (default:
	smtpd) to control the name of the SASL configuration file
	used by the Postfix SMTP server. Liviu Daia. Files:
	mail_params.h, smtpd.c, smtpd_sasl_glue.c.

	Cleanup: the LDAP client configuration parser is now shared
	between the LDAP, MySQL, and PGSQL clients.  Liviu Daia.
	Files: global/cfgparser.[hc], global/dict_ldap.c,
	global/dict_mysql.c, global/dict_pgsql.c and documentation.

	Cleanup: moved "util" modules with dependencies on higher-level
	"global" code from the util directory to the global directory:
	util/dict_open.c, global/cfgparser.[hc], global/dict_ldap.c,
	global/dict_mysql.c, global/dict_pgsql.c, global/mail_dict.c.

	Cleanup: the new queue manager nqmgr replaces the default
	queue manager qmgr, leaving behind a hard link for backwards
	compatibility. The old queue manager remains available as
	as oqmgr but will eventually be removed.

	Bugfix: vstring_get() etc. now return VSTREAM_EOF when they
	terminate prematurely, instead of returning the last
	character stored.  This avoids mis-leading warnings. File:


	Cleanup: don't bother the flush daemon while deferring mail
	if the destination is not "fast flush" eligible. File:

	Safety: the SMTP server flushes recipients to the cleanup
	server in order to avoid SMTP timeouts when virtual or
	canonical expansions take a lot of time. File smtpd/smtpd.c.

	Safety: add warnings to postmap and postalias when table
	lookup results in an empty string.


	Example: script to run qmail-local from Postfix by Ron

	Change: queue minfree limit is now 1.5 * message size limit.
	File: smtpd/smtpd_check.c.

	Bugfix: apply hostname restriction even when host address
	lookup fails in check_{sender,recipient}_{ns,mx}_access.
	File: smtpd/smtpd_check.c.


	Performance: allow delivery concurrency to increase even
	while mail is deferred, as long as the delivery agent does
	not report really serious trouble with the destination.
	Files:  *qmgr/qmgr_deliver.c.

	Cleanup: in postfix-files, symbolic links and hard links
	are now first-class citizens with explicit mention of source
	and destination pathnames. Files: postfix-install,
	conf/postfix-files, conf/post-install.


	Cleanup: sendmail -v caused one mail delivery report upon
	every delivery attempt, not just the first one. The fix is
	to "kill" a queue file record after the first delivery
	attempt. This means a new record type. Files:  *qmgr/qmgr_active.c,
	*qmgr/qmgr_message.c, global/rec_type.c.

	Cleanup: in anticipation of other built-in rate limiters,
	the client_connection_rate_time_unit parameter is renamed
	to client_rate_time_unit.

	Documentation: finished the HOSTING_README file with an
	overview of methods to host domains with Postfix.


	Bugfix: anvil (count and rate limiting) server race condition
	could result in dangling pointer.  Postfix erases memory
	after allocating and before freeing, so it is extremely
	unlikely that this could be used to bring harmful data into
	the anvil server. File anvil/anvil.c.


	Cleanup: new header_checks(5) and body_checks(5) manual
	pages.  The sample-regexp* and sample-pcre* files are no
	longer needed and have been removed, as are the default
	*_table configuration files.

	Cleanup: support for the non-standard Errors-To: header is
	removed. File: cleanup/cleanup_message.c.


	Feature: "PREPEND headername: headervalue" action in Postfix
	access maps, to facilitate external policy servers that
	label mail instead of rejecting it. Files: smtpd/smtpd.c,


	UNDO the 20040104 change (vstring_get() etc. return
	VSTREAM_EOF when they terminate prematurely, instead of
	returning the last character stored, to avoid mis-leading
	warnings). File:  global/vstring_vstream.c.

	Portability: test -e is not portable. File: conf/postfix-script.

	Misc. documentation fixes by Victor Duchovni.

	Documentation: the README files are now hyperlinked, and
	are referenced in the on-line manual pages.

	Bugfix: the pickup daemon now strokes the watchdog frequently
	to prevent the watchdog from barking when mail arrives
	faster than it can be picked up. File: pickup/pickup.c.


	Feature: set smtpd_reject_unlisted_{sender,recipient}=no
	to turn off automatic rejection of non-existent local,
	virtual or relay addresses. This way it can be made
	conditional for local clients, always on for remote clients.
	Files:  global/mail_params.h, smtpd/smtpd.c, smtpd/smtpd_check.c.


	Feature: PREPEND in header/body_checks, for message tagging.
	File: cleanup/cleanup_message.c.


	Safety: handle the case that main.cf is updated while it
	is being read. File: util/dict.c.

	Feature: "instance" attribute that links policy etc. queries
	to the same message instance.

	Cleanup: the mynetworks setting may now be empty. File:


	Bugfix: missing flush_init() call. Introduced 20040105.
	File: postqueue/postqueue.c.


	Cleanup: clnt_stream derived classes now try to detect that
	the server has disconnected before sending data and warning
	about an error. File: global/clnt_stream.c.


	Bugfix: changed mis-leading warning about text>4096 characters
	into "unexpected end-of-input". File: util/attr_scan0.c.


	Feature: sasl_method, sasl_username and sasl_sender attributes
	in smtpd policy queries. Files: src/smtpd/smtpd_check.c.


	Safety: smtpd_soft_error_limit now determines when
	$smtpd_error_sleep_time starts to take effect.

	Cleanup: local(8) and virtual(8) will now create maildirs
	in a world-writable directory. Files: util/make_dirs.c.

	Bugfix: don't panic on a corrupt queue file.  File:


	Cleanup: sample-filter.cf is gone. Better documentation is
	available with "man header_checks".


	Bugfix: when delivery to smtpd_proxy_filter fails, report
	"451 Queue file write error" instead of repeating the
	previous "354 End data with <CR><LF>.<CR><LF>" response.
	File:  smtpd/smtpd.c.


	Compatibility: accept and ignore the sendmail -bh and -bH
	mode of operation requests.


	Bugfix: SMTPD proxy didn't send QUIT as the result of code
	duplication. Evidence reported by Mark Martinec. File:


	Bugfix: bad address syntax was passed to transport map
	lookups.  Problem reported by Andrei Koulik. File:
	util/match_ops.c, trivial-rewrite/resolve.c.


	Portability: ekkoBSD support by Philip Reynolds.  Files:
	makedefs, util/sys_defs.h.


	Cleanup: smtp_skip_4xx_greeting and smtp_skip_5xx_greeting
	functionality is moved from connection management to SMTP
	protocol processing, so that Postfix now logs the server
	response when a server refuses to provide service.  Files:
	smtp/smtp_connect.c, smtp/smtp_proto.c.

	Cleanup: smtp_skip_4xx_greeting is no longer configurable;
	it is now permanently turned on.


	Workaround: in the trivial-rewrite server, turn on the code
	to strip trailing "." while rewriting addresses, and change
	the address resolver to strip trailing "." in a compatible
	manner.  This does not eliminate the problem that the SMTP
	server may use a different address for recipient validation
	than what the cleanup server uses for virtual alias mapping.


	Bugfix: the SMTP server did not log client (and SASL)
	information with the real-time content filter was enabled.
	Files: smtpd/smtpd.c, smtpd/smtpd_sasl_proto.c.

	Compatibility: smtpd_reject_unlisted_sender is turned off
	by default, to avoid trouble with with in-house software
	that sends out mail software with an unreplyable address.


	Bugfix: postdrop should not abandon mail submission after
	receiving a SIGHUP signal when SIGHUP was ignored by the
	parent process.  Victor Duchovni, Morgan Stanley.  File:

	Bugfix: parsing bug in PgSQL dictionaries causing UNIX
	sockets to be ignored. Liviu Daia. Files: global/dict*sql.c.

	Performance: allow MySQL and PgSQL database connections to
	be closed when idle for more than 1 minute; Liviu Daia.
	Files: global/dict*sql.c.


	Sanity: the SMTP server no longer accepts sender or recipient
	addresses that end in the "@" null domain, as well as
	addresses that rewrite into such a form.  Specify
	"resolve_null_domain=yes" to get the old behavior back.
	File:  trivial-rewrite/resolve.c.


	Cleanup: added WARN action support for access maps, for
	consistency with the WARN action in header and body checks.
	File:  smtpd/smtpd_check.c.


	Bugfix: missing return statement at the end of the
	FREE_MEMORY_AND_RETURN error handling macro. Adi Prasaja.
	File: trivial-rewrite/resolve.c.


	Future proofing: client_rate_time_unit is renamed to
	anvil_rate_time_unit, so that it is no longer limited to
	clients only. File: src/global/mail_params.h.

	Cleanup: postalias and postmap now log problems to syslogd.
	Files: postalias/postalias.c, postmap/postmap.c.


	Feature: "postfix set-permissions" (re)sets ownership and
	access permissions of Postfix files and directories.

	Feature: "postfix upgrade-configuration" updates main.cf
	and master.cf. This is for people who people copy over
	their old files after installing a newer Postfix version.

	Feature: HTML files are now optionally installed under
	control of the html_directory configuration parameter.
	Files: postfix-install, conf/postfix-files, conf/post-install.

	Cleanup: README file installation is now optional.  Files:
	postfix-install, conf/postfix-files, conf/post-install.


	Cleanup: references to sample-mumble.cf files removed,
	conf/mumble_table files removed, new commands added to

	Cleanups: function declared int but used as void, missing
	include file, missing const qualifier, unused variable.
	Matthias Andree. Files:  bounce/bounce_notify_util.c,
	bounce/bounce_service.h, postlog/postlog.c, smtpd/smtpd_check.c,

	Bugfix: more robust version of SIGHUP test of 20040331.
	Victor Duchovni, Morgan Stanley. File: postdrop/postdrop.c.

	Safety: added NOCLOBBER qualifiers to local variables that
	might be clobbered by longjmp(). Files: util/sys_defs.h,
	smtp/smtp_proto.c, lmtp/lmtp_proto.c, smtpd/smtpd_check.c,

	Bugfix: sub-level Makefiles no longer turned on the extra
	compiler warnings. Files: Makefile.in.*, makedefs.*.


	Bugfix: the LMTP client attempted to reuse a connection
	after timeout, causing protocol synchronization errors.
	Reported by Rob Mueller. File: lmtp/lmtp.c.


	Cleanup: non-delivery reports now include the original
	recipient information. File: bounce/bounce_notify_util.c.


	Typos: many documentation fixes by Rob Foehl.


	Cleanup: "int" versus "const int" prototype mismatch between
	the DICT sequence method prototype and possible implementations.
	Files: util/dict_db.c, util/dict_dbm.c.


	Bugfix: the code that rejects client/helo RESTRICTIONS with
	smtpd_delay_reject=no looked at the wrong evidence and
	rejected client/helo ACCESS MAP lookups instead. Michael
	Tokarev. Files:  smtpd/smtpd.c, smtpd/smtpd_check.c.

	Bugfix: missing # in master.cf in optional submission


	Bugfix: smtpd logged the client too often. Michael Tokarev.
	File: smtpd/smtpd.c.

	Cleanup: client_event_status_update_time renamed to
	anvil_status_update_time. Files: mantools/postlink,
	proto/postconf.proto, anvil/anvil.c.


	Workaround: allow pipelined SMTP clients to overshoot the
	SMTP server recipient limit without triggering the server
	hard error limit.  The SMTP server does not count "too many
	recipients" towards the hard error limit, as long as the
	number of excess recipients stays within a configurable
	overshoot limit (default: smtpd_recipient_overshoot_limit
	= 1000).  Solution in cooperation with Victor Duchovni.
	Files:  smtpd/smtpd.c, smtpd/smtpd_state.c, smtpd/smtpd.h.


	Missing test for a never used flag (the problematic and
	thus never completed INSPECT feature that doesn't re-inject
	mail into Postfix).  Victor Duchovni, Morgan Stanley. File:


	Bugfix: missing "sasl enabled" guard in the SMTPD policy
	client.  File: smtpd/smtpd_check.c.


	Portability. UnixWare has strcasecmp() in strings.h.  Patch
	by Andreas Winkelmann. File: util/sys_defs.h.

	Portability. The postlink script is transformed from sed(1)
	to perl(1).


	Portability. Introduced SET_H_ERRNO() macro for compilation
	environments where h_errno can't be used as an lvalue.
	Files:  util/sys_defs.h, dns/dns_lookup.c.

	Portability. Eliminate assumption on bits per byte from


	Bugfix: the SMTP client did not reset per-session EHLO,
	SASL, and history information when opening a connection to
	an alternate SMTP server.  This is the result of abstraction
	no longer matching function. Reported and diagnosed by
	Victor Duchovni, Morgan Stanley.

	Bugfix: non-portable reuse of variadic argument lists.
	Fix by Victor Duchovni, Morgan Stanley. Files:  global/bounce.c,
	global/defer.c, global/sent.c, global/trace.c, global/verify.c.

	Portability: NetBSD 2.0 has changed from statfs to statvfs.
	John Heasley. File: util/sys_defs.h.

	Documentation: typo fixes by IKEDA Nozomu.


	Bugfix: one missed variadic argument list fix. Victor
	Duchovni, Morgan Stanley. File: global/verify.c.

	Bugfix: the resolver client cache should be context dependent
	because address verification probes may use a different
	route than normal mail deliveries. File: global/resolve_clnt.c.

	Safety: added similar context dependence to the address
	rewriting client in order to avoid trouble when Postfix is
	changed. File: global/rewrite_clnt.c.

	Bugfix: space in HELO commands could end up in XFORWARD
	commands.  File: smtpd/smtpd.c.


	Code reorganization: in preparation for SMTP session caching,
	the SMTP client data structures were changed from the
	original "one session per delivery request" model to an
	explicit "multiple sessions per delivery request" model.
	This uncovered ESMTP and SASL missing re-initialization
	problems that were fixed in past week.  Design by Victor
	and Wietse, initial implementation by Victor Duchovni.


	Future proofing: after the reorganization of SMTP request
	state and session state, added code to the smtp client
	error handling routines to more consistently deal with the
	possibility that session information is not available.


	Feature: directory=pathname option for the pipe(8) delivery
	agent. This allows a command to run from a fixed directory.
	Failure to change directory causes delivery to be deferred.
	Files: pipe/pipe.c.

	Feature: command_execution_directory for local(8) delivery
	to external command. This supports the usual $home etc.
	expansions, subject to filtering with the character set
	specified with $execution_directory_expansion_filter.
	Failure to change directory causes delivery to be deferred.
	Files:  global/mail_params.h, local/command.c.

	Support for external command execution directory. Files:


	Safety: when mail is delivered to a transport with per-delivery
	recipient limit of 1, split the recipient address on the
	recipient delimiter if one is defined, so that extended
	addresses don't get extra delivery concurrency slots.
	Files: *qmgr/qmgr_message.c.


	Workaround for fragile clients: add microsecond time to
	maildir filename.  Files: virtual/maildir.c, local/maildir.c.


	SMTP connection caching work with Victor Duchovni.

	New module (later renamed to global/scache_single.c) for
	protocol-independent session caching.  The initial
	implementation supports in-process, single-session caching
	only.  A later version will support a central session cache
	daemon.  Some more work is needed for passivation/activation
	of session attributes.

	New function vstream_fdclose() to destroy a VSTREAM while
	leaving the underlying file(s) open. Files: util/vstream.[hc].

	New function dns_rr_remove() to remove one record from a
	resource record list. Some more work is needed to turn the
	list into a doubly-linked one. Files: dns/dns.h, dns/dns_rr.c.

	Restructuring of the SMTP protocol engine for session
	caching. File: smtp/smtp_proto.c.

	Restructuring of the connection management module, and
	first implementation of SMTP connection caching.  To enable,
	specify an smtp_connection_cache_time value greater than
	zero. The time unit is seconds. File: smtp/smtp_connect.c.

	New code to passivate and re-activate SMTP_SESSION objects,
	and isolation of session save/lookup in its own module.
	Files: smtp/smtp_session.c, smtp/smtp_reuse.c.

	Refinement: smtp_cache_reuse_limit parameter to bound the
	number of times a session may be reused.  

	Refinements: when a session comes from the cache, give it
	back to the cache anyway (even when it will not be listed
	under the next-hop destination name).

	Future refinements should also include a bound on the number
	of consecutive and total non-delivering uses and other


	Bugfix: the code to eliminate the local MTA from the MX
	address list did not handle the case that inet_interfaces
	produced a less preferred match than proxy_interfaces.
	Victor Duchovni, Morgan Stanley. File: smtp/smtp_addr.c.


	Resume work on SMTP session caching.  All good sessions
	are now cached under their IP address. As before, only the
	first good session per delivery request is cached under
	the original next-hop destination.

	At this point, SMTP session caching works, with a session
	cache client module that uses in-process session caching.
	This is sufficient to demonstrate that the SMTP client is
	ready for session caching.


	New modules to send file descriptors from one process into
	another one. This will be needed for implementing a central
	connection cache manager daemon. Most systems use UNIX-domain
	sockets as the transport for this. On Solaris we use streams
	instead.  Applications are supposed to invoke LOCAL_SEND_FD()
	and LOCAL_RECV_FD().  Files: {unix,streams}_{send,recv}_fd.c.


	First implementation of a session caching client API that
	actually sends to/receives from a caching server process.
	The old in-process, single-session caching functionality
	is preserved as global/scache_single.c, so that we can use
	it for bootstrapping the session cache server. File:

	First implementation of the scache session cache server,
	using the same in-process session caching code that was
	used to bootstrap the SMTP client.  File: scache/scache.c.


	Performance: the default RSET timeouts are reduced from
	120s to 20s.  Perhaps there should be different RSET timeout
	for address probes and for session cache checks. File:


	Multi-session connection cache module. Implementing this
	was actually the easiest part of the entire connection
	caching project. File: global/scache_multi.c.


	Bugfix: event_drain() falsely reported a single-entry timer
	queue as empty.  File: util/events.c.

	Completed the multi-session cache support for SMTP. The
	code can be stress tested with a driver program that reads
	commands from a script. It is not practical to manually
	test the effects of collisions in the time or in name space
	domains. File:  global/scache.c.


	Feature: the session cache server now logs cache hit and
	miss statistics every $session_cache_status_update_time
	seconds (default: 600s), as well as upon process exit.
	File:  scache/scache.c.


	Workaround: LINUX 2.4 has trouble with mixed data and file
	descriptor traffic on UNIX-domain stream sockets.
	Specifically, it cannot handle data write (read) followed
	by file descriptor send (receive): the receiver hangs in
	recvmsg(). Workaround is to insert an intervening read
	(write) operation.  Presumably, LINUX 2.4 is confusing the
	data and file descriptor.  Lucky Ralf Hildebrandt.  Files:
	util/sys_defs.h, global/scache_clnt.c, scache/scache.c.


	Safety: spawn(8) now rejects a user with the -1 UID or GID
	value, so that commands will not end up running as root.
	Files:  util/spawn_command.c, spawn/spawn.c.

	User interface: parameter smtp_connection_cache_domains
	renamed to smtp_connection_cache_destinations. Destinations
	listed here must be specified without [] or :port.  File:

	Bugfix: "421 Timeout exceeded" wasn't guarded by setjmp().
	Victor Duchovni, Morgan Stanley. File: smtpd/smtpd.c.


	Feature:  enable SMTP session caching temporarily while a
	postfix is able to schedule back-to-back deliveries.
	Parameter:  smtp_connection_cache_on_demand (default:
	yes).  Files:  smtp/smtp_connect.c, *qmgr/qmgr_entry.c,
	*qmgr/qmgr_queue.c, *qmgr/qmgr_deliver.c.

	Feature: smtp-source -N option to generate unique recipient
	addresses for (trivial-rewrite) stress testing. Victor
	Duchovni, Morgan Stanley. File: smtpstone/smtp-source.c.


	Safety: disallow "opportunistic session caching" when the
	queue manager is unable to schedule back-to-back deliveries.
	File: *qmgr/qmgr_entry.c.


	Hysteresis: turn on "opportunistic session caching" when
	back-to-back deliveries happen, but don't turn if off
	until both concurrent and back-to-back delivery ends.


	Workaround: disable session caching for Linux < 2.2 (does
	not work) or Glibc < 2 (does not compile).  Files:
	util/sys_defs.h, util/unix_{recv,send}_fd.c.

	Portability: h_errno is not an lvalue in the UnixWare 7.1
	multi-threaded environment. Olivier PRENANT.


	Bugfix: update SMTP server error counter when a client is
	denied access with smtpd_delay_reject=no.


	Bugfix: The smtp_chat_cmd() forced output flushing code in
	the SMTP client could run before an I/O error handler was
	set up.  Problem diagnosed by Victor Duchovni, Morgan
	Stanley. The fix is to disable the smtp_chat_cmd() forced
	output flushing code as it duplicates better code in
	smtp_loop(). File: smtp/smtp_chat.c.

	Safety: set up an I/O error handler before the smtp_loop()
	protocol engine starts; this handler logs a warning in case
	it ever runs, because that means someone broke ESMTP command
	pipelining.  File: smtp/smtp_proto.c.

	Feature: canonical_classes parameter by Kimmo Suominen, to
	control what addresses are rewritten by canonical_maps.
	Files: cleanup/cleanup_addr.c, cleanup/cleanup_message.c.


	Bugfix: update the vstream I/O time AFTER the completion
	of an I/O request, so that time-sensitive applications
	don't force flush output too soon and possibly trigger
	NAGLE delays.  Problem diagnosed by Victor Duchovni, Morgan
	Stanley. File: util/vstream.c.

	Portability: avoid postmap/postalias test file name clashes
	on Windows.  Ian Lance Taylor (of Taylor UUCP fame).


	Bugfix: vstream_popen() did not close the child pipe
	after failure to fork(). File: util/vstream_popen.c.


	Feature: support for systems with closefrom(), and emulation
	for those without. Andrew Brown. Files:  util/sys_defs.h,


	Feature: {sender,recipient}_canonical_classes parameters,
	which give better control than sender_canonical_classes.
	Files: cleanup/cleanup_addr.c, cleanup/cleanup_message.c.

	Feature: the proxymap client now recognizes when a map
	can't be proxied, and will open it directly instead.  This
	makes proxy maps easier to use for virtual mailbox domains.
	File: global/dict_proxy.c.

	Feature: smtp_sasl_mechanism_filter restricts what remote
	SMTP server mechanism names the Postfix SMTP client passes
	on to the SASL library.  Victor Duchovni, Morgan Stanley.
	Files: smtp/smtp.c.  smtp/smtp_sasl_glue.c, smtp/smtp_sasl_proto.c.


	User interface: when no recipients are specified, the
	Postfix sendmail command now terminates with status EX_USAGE
	instead of accepting the mail first and bouncing it later.
	This gives more direct feedback in case of a common client
	configuration error. File:  sendmail/sendmail.c.


	Portability: Solaris closefrom() support didn't work for
	non-SUN compilers. Victor Duchovni, Morgan Stanley.


	Feature: the scache(8) session cache manager now logs the
	peak counts of destinations, endpoints and sessions. Files:
	scache/scache.c, global/scache*c.


	Portability: disable session caching support on SCO 5
	because of incompatible sockets API. File: util/sys_defs.h.


	Bugfix (introduced 20020803): sent the wrong bounce message
	type when a Delivered-To: loop was detected for a mailing
	list alias.  Nicolas Riendeau. File: bounce_notify_util.c.


	Feature: authorized_flush_users, authorized_mailq_users,
	authorized_submit_users to restrict what users can flush
	the queue, list the queue, or submit mail locally.  Based
	on code by Victor Duchovni, Morgan Stanley. Files:
	sendmail/sendmail.c, postdrop/postdrop.c, postqueue/postqueue.c,

	Feature: discard(8) mail delivery agent.  Victor Duchovni,
	Morgan Stanley. File: discard/discard.c.


	Long overdue, a master(5) manual page based on an initial
	version by Magnus Baeck.

	By popular demand, a postfix-manuals.html web page with
	totally useless links to UNIX-style manual pages (the same
	information should already be available simply by typing
	"apropos postfix"). To keep newbies from getting completely
	lost due to information overload, the document starts with
	a list of actually useful pointers to Postfix introductions,
	duplicated from the already existing documents.html.


	Bugfix: "sendmail -bv" did not reject the -t option.  File:


	Feature: SASL authentication attributes are now stored in
	queue files and passed on to delivery agents, by Leandro
	Santi. Files:  deliver_pass.c, deliver_request.c,
	qmgr_deliver.c, qmgr_message.c, pipe.c, smtpd.c.


	Feature: per SMTP client message rate limit and recipient
	rate limit, by Ragnar Lonn, GHN network technologies.
	Files: smtpd/smtpd.c, anvil/anvil.c, global/anvil_clnt.[hc].

	Incompatibility: smtpd_client_connection_limit_exceptions
	renamed to smtpd_client_event_limit_exceptions, because it
	now also controls message and recipient rate limit control.


	Portability: AIX 5.1/GCC.


	Postfix no longer appends the local domain to header
	addresses from remote clients.  Instead, Postfix either
	does not rewrite those headers at all, or it appends the
	domain specified with the new remote_header_rewrite_domain

	Postfix still appends $@myorigin or .$mydomain to headers
	from the Postfix sendmail command, or from clients listed
	with the new local_header_rewrite_clients parameter (default:
	permit_mynetworks, permit_sasl_authenticated).

	These changes affect the SMTP server (including XFORWARD
	support), the cleanup server (do or don't rewrite headers),
	the trivial-rewrite server (append local domain or surrogate
	remote domain to incomplete addresses), the queue manager
	(send additional attributes to delivery agents), the LMTP
	and SMTP clients (XFORWARD support), and the local delivery
	agent (preserve XFORWARD attributes when forwarding mail).


	Bugfix: attr_clnt_request() did not properly skip hash
	table arguments. Luc Pardon, Skopos Consulting. File:


	The NIS+ module by Geoff Gibbs is now part of Postfix.
	Files: util/dict_nisplus.c, proto/nisplus_table.


	Support for Errors-To: is permanently removed.


	Bugfix: "smtp_connection_cache_on_demand=no" could crash
	the SMTP client. File: smtp/smtp_connect.c.

	Robustness: extra sanity checks. Files: util/dict_db.c,
	util/dict_dbm.c, dict_nis.c.


	Initial merge of Lutz Jaenicke's TLS patch. Initial rewrite
	of tlsmgr to eliminate some code duplication and to postpone
	calls into OpenSSL until after dropping privileges.


	Compatibility: "session cache" renamed to "connection cache"
	to avoid confusion with the TLS session cache.


	Feature: smtpd_end_of_data_restrictions allow you to specify
	restrictions at the end of the SMTP DATA command. The syntax
	is identical to that of the smtpd_data_restrictions feature.
	This introduces a new END-OF-DATA protocol state for the
	external policy server. Files:  proto/SMTPD_POLICY_README.html,
	proto/SMTPD_ACCESS_README.html, smtpd/smtpd_check.c.


	Cleanup: terminate the dict_eval() result buffer for verbose
	logging.  Victor Duchovni, Morgan Stanley. File: util/dict.c.


	Cleanup: be more careful when saving and restoring resolver(3)
	options to avoid problems with an HP-UX security patch
	(change introduced 20031215). File:  dns/dns_lookup.c.


	Bugfix: the test for "no debugger_command" was wrong.
	Leandro Santi. File: global/debugger_command.c.


	Robustness: the master-child protocol now includes a process
	generation number besides the child process ID.  The process
	generation number is incremented by one each time the master
	creates a child process. Child-to-master status updates
	with the wrong generation number are ignored, instead of
	triggering a consistency error in the master server.  Files:
	master/*server.c, master/master_status.c, master/master_spawn.c.


	Bugfix: the "local_header_rewrite_clients" feature (20041023)
	did not recognize "bare" lookup tables as documented.  Victor
	Duchovni, Morgan Stanley. File: smtpd/smtpd_check.c.

	Bugfix: the "local_header_rewrite_clients" feature (20041023)
	was broken because the local delivery agent passed on a
	bogus attribute value when forwarding internally generated
	mail, causing the mail to be rejected by the cleanup server.
	File: local/dotforward.c.

	Bugfix: the "local_header_rewrite_clients" feature (20041023)
	was broken because the pickup server always overwrote origin
	information. Files: pickup/pickup.c, cleanup/cleanup_state.c,

	Workaround: enable the "can't write before sending a file
	descriptor" workaround for Solaris. Problem reported by
	Victor Duchovni for Solaris 2.5.1, but we play safe and
	enable it unconditionally.


	The TLS support routines are moved to a "tls" directory,
	and are published via the "libtls.a" object library.


	Infrastructure: support for binary attribute values
	(ATTR_TYPE_DATA) in Postfix IPC messages. Files:
	util/attr_scan*c, util/attr_print*c.


	TLS support: via a process of gradual transformation,
	decomposed Lutz Jaenicke's pfixtls.c into separate modules
	for clients, servers, certificate verification, session
	caching, and PRNG management. Global variables were eliminated
	so that the code now supports multiple client and/or server
	contexts in the same process.  Files:  tls/*.[hc].


	TLS support: eliminated shared access (and locking) of the
	TLS PRNG exchange file and TLS session caches. Instead,
	Postfix uses a client-server protocol, and the tlsmgr
	becomes the sole mediator. This eliminated the need for
	1000+ lines of SDBM support, and eliminated the need for
	running a persistent tlsmgr process on systems don't enable
	TLS in main.cf.


	Feature: configurable list of forbidden SMTP commands
	(default: smtpd_forbidden_commands = CONNECT, GET, POST)
	after which the Postfix SMTP server disconnects immediately.
	The SMTP server always disconnects immediately when the
	client sends a message header instead of an SMTP command.
	Magnus Baeck.  File: smtpd/smtpd.c.


	CDB support by Michael Tokarev, documentation by Victor
	Duchovni. Files: util/dict_cdb.[hc], global/mkmap_cdb.c.


	Completed support for the Berkeley DB sequence operator.
	This is needed for finding and deleting old entries in TLS
	session databases. File:  util/dict_db.c.

	Bugfix: the DBM client's sequence operator used exclusive
	locking instead of shared locking. File: util/dict_dbm.c.

	Feature: dump an entire database with the new postmap/postalias
	"-s" option. This works only for database types with Postfix
	sequence operator support: hash, btree, dbm, and sdbm.
	Files:  postmap/postmap.c, postalias/postalias.c.


	Solaris 10/ix86 chroot setup script update by J.D. Bronson.

	TLS support: cosmetic changes to comments and messages;
	completed the code for the master -> tlsmgr trigger handshake,
	so that the master no longer complains about trigger
	responses timing out.


	Updated the SDBM dictionary interface. It had fallen behind
	with the Postfix dictionary interfaces that were already
	bundled with Postfix. Files: util/dict_sdbm.[hc].

	Cleanup: "postconf -m" (show all available map types) now
	produces sorted output.  File: util/dict_open.c.


	No bugfix: tests with the new "postmap -s" feature show
	that SDBM first/next operations never worked with Postfix/TLS
	patch 20040829 (verified with the 20040829 dict_sdbm.c
	module on Linux and FreeBSD).  The code stops after finding
	one database element.  Other SDBM versions found on the
	Internet will find all database entries, but report an I/O
	error after the last database element is found. All this
	would be easy enough to fix, but the SDBM library is not
	part of Postfix, and never will be.

	Bugfix: the sequence operator in the DBM and SDBM clients
	released the shared lock after reading the next key but
	before reading the corresponding value. This was never a
	problem, because the sequence operator was used only in
	the Postfix/TLS patch. This used the SDBM sequence operator
	which didn't work as discussed above. Files:  util/dict_dbm.c,

	Feature: the local(8) and pipe(8) delivery agents now make
	the following attributes available upon delivery (with
	local(8) names must be spelled in upper case): client_hostname,
	client_address, client_protocol, client_helo, sasl_method,
	sasl_sender, sasl_username. Files: local/command.c,
	pipe/pipe.c, and lots of documentation.


	"postcat -o" now prints queue file record offsets; this is
	useful for debugging. File: postcat/postcat.c.

	NON-PRODUCTION Bugfix: (bug introduced while adopting the
	Postfix/TLS patch):  the new TLS certification call-back
	routine expects that the peer hostname is in
	tlscontext->peername_save, but the TLS server code never
	updated this field.  File:  tls/tls_server.c.


	Feature: selective suppression of SMTP extensions (pipelining,
	starttls, auth, etc.); this is useful to work around broken
	clients or servers.  Specify a list of EHLO keywords with
	the smtp(d)_discard_ehlo_keywords parameters, or specify
	one or more lookup tables, indexed by remote network address,
	with the smtp(d)_discard_ehlo_keyword_address_maps parameters.
	EHLO keyword lists are case insensitive.  Files:
	util/name_mask.[hc], global/ehlo_mask.[hc], smtpd/smtpd.c,
	smtp/smtp.c, smtp/smtp_proto.c.


	Bugfix: postcat without -o was broken. File: postcat/postcat.c.


	NON-PRODUCTION Bugfix: (bug introduced while adopting
	Postfix/TLS patch):  don't call smtp_flush() after return
	from vstream_setjmp(), we'll call you.  File: smtpd/smtpd.c.

	Dummy VSTREAM read-write routines. Files: util/dummy_read.c,


	Fixes for TLS_README by Victor Duchovni. File:

	NON-PRODUCTION Bugfix: (bug introduced while adopting
	Postfix/TLS patch).  The client code had become too similar
	to the server implementation, and also required a host
	certificate and key. Fix by Victor Duchovni. File:


	Bugfix: further postcat corner cases.


	Cosmetic: don't log disconnect events as I/O errors.
	File: tls/tls_bio_ops.c.


	Infrastructure: unified IPv4/IPv6 name/address API so that
	Postfix can support IPv6 without #ifdef INET6 everywhere.
	In particular, we allow #ifdef in libraries but avoid it
	in applications.  Files:  util/myaddrinfo.[hc],
	util/sock_addr.[hc], dns/dns_rr_to_pa.c, dns/dns_sa_to_rr.c,
	dns/dns_rr_eq_sa.c, dns/dns_rr_to_sa.c, inet_proto.[hc].

	Postfix no longer attempts to deliver mail via IPv6 when
	the system has no IPv6 connectivity.  Network protocol
	support is now selected with the "inet_protocols" configuration
	parameter, instead of "inet_interfaces". The "inet_protocols"
	parameter also controls what DNS lookups Postfix will do.

	Infrastructure: eliminated two host/port parsing routines.
	Only one survives: host_port(), in an extended form that
	allows for missing host or missing service information but
	not both. File: util/host_port.c.


	Milestone: Postfix with the unified IPv4/IPv6 socket/name
	API builds without compiler error on IPv4-only system and
	actually works.


	Bugfix: SMTPD_PROXY_README incorrectly claimed that ":port"
	in master.cf causes a server to listen only on "localhost"
	without exposing the service to the network.  Instead,
	":port" causes a client to connect to "localhost".


	Linux workaround:  when mynetworks isn't set, a chrooted
	process could not read the IPv6 address information from
	/proc.  We now invoke own_inet_addr() before chrooting,
	while processing main.cf. File: global/mail_params.c.


	Workaround for (Linux) systems without IPV6_V6ONLY support
	(RFC 3493).  When Postfix listened on an IPv4 wild-card
	smtp socket, the IPv6 wild-card smtp listener would fail
	with EADDRINUSE (and vice versa).  File: util/myaddrinfo.c.


	Safety: when the IPV6 netmask can't be determined, assume
	/128 (host only). File: util/inet_addr_local.c.


	Re-implemented IPv6 support for net/mask pattern matching.
	Files:  util/cidr_match.[hc], util/dict_cidr.c,
	util/match_ops.[hc], proto/cidr_table.


	Moved mask_addr() to its own module so that it could also
	be called by mynetworks() and inet_addr_local() to remove
	non-zero host bits from IPv6 network/mask patterns. File:


	Re-implemented IPv6 support for network interface lookup
	via the Linux /proc file system. File:  util/inet_addr_local.c.


	Feature: specify "inet_interfaces = loopback-only" for
	servers that must listen on local interfaces only, without
	having to specify IPv4 and/or IPv6 addresses in main.cf or
	master.cf.  File:  global/own_inet_addr.c.

	Workaround: AIX 5.1 getaddrinfo() can't handle a null host
	argument with AI_PASSIVE. Instead we specify an explicit
	protocol family, a host of "::" or "", and turn off
	IPV6_V6ONLY. Files: util_myaddrinfo.c, util/inet_listen.c.

	Workaround: AIX 5.1 getaddrinfo() can't handle a "0" service
	argument. Instead we specify "1".  Files: util/inet_addr_host.c.


	Cleanup: now that the over-all structure is proving itself,
	clean up some internal APIs to increase robustness and get
	rid of some clumsiness. Mainly, the getaddrinfo(3) interface.

	Start-up performance: the hash_queue_names default setting
	is reduced from eight directories to just defer and deferred.
	This reduces time for checking the Postfix queue. Files:
	conf/post-install, global/mail_params.h.


	Further cleanup: eliminate duplicate IPv6 results when the
	mynetworks value is generated by Postfix. More documentation
	of the new internal APIs.

	Performance: reduced start-up delay by moving warning-only
	startup checks into the background. File: conf/postfix-script.


	Further hardening of the IPv6 support: don't trust system
	libraries to protect Postfix against malformed IPv6 address
	literals. Their syntax is complex enough that errors are
	likely. Files: global/resolve_local.c, util/valid_hostname.c.

	Further cleanup: RFC 2821 requires the IPv6: prefix with
	IPv6 address strings.  The smtp and qmqp servers maintain
	separate address instances, the bare address and the RFC
	2821 compatible form, and use each where appropriate.  This
	strict separation simplifies address syntax checks as well
	as the implementation of XCLIENT and XFORWARD.


	Infrastructure: new valid_mailhost_addr() routine to verify
	that an address literal satisfies RFC 2821. An IPv4 address
	is in dotted-quad decimal form, and an IPv6 address is in
	hexadecimal form, with the "IPv6:" prefix. Files:

	Further cleanup: valid_hostname() no longer allows network
	addresses or numerical domain names. While it made some
	sense with IPv4 dotted quad decimal forms, with IPv6 it
	just made no sense anymore.  Again, being stricter actually
	simplifies code. Files:  util/valid_hostname.c and a
	surprisingly small number of valid_hostname() callers that
	did not reject numerical forms.

	Bugfix: in the Postfix 2.2 SMTP client, the debug_peer_init()
	call was moved to the after-chroot initialization.


	Performance: reduced start-up delay by moving warning-only
	startup checks into the background; they now start after
	one minute to allow the system to finish booting. File:

	Milestone: first non-non-production snapshot with IPv6.


	Milestone: first non-non-production snapshot with TLS.


	Workaround: don't send mail to $fallback_relay if Postfix
	is MX host for the next-hop destination. This is, however,
	a partial solution. The documentation has been updated to
	cover all the cases where a fallback_relay could interfere
	with the operation of a backup or primary MX host. Files:
	smtp/smtp_addr.c, smtp/smtp_connect.c.


	Configuration: Postfix daemons that need privileged operation
	(such as local, pipe, or spawn) now log a fatal error when
	they are configured in master.cf as unprivileged.


	Cleanup: simplified the handling of receive_override_options
	settings. Files: pickup/pickup.c, smtpd/smtpd.c, qmqpd/qmqpd.c,

	Feature: permit_inet_interfaces allows a request when the
	client matches $inet_interfaces. This is used for generic
	access restrictions and for header address rewriting control.
	Files: global/mail_params.h, smtpd/smtpd_check.c.

	Cleanup: by default, message header address rewriting is
	now enabled only for mail that originates from the machine
	itself. Files: global/mail_params.h, smtpd/smtpd_check.c.


	Bugfix: when extracting recipients from message headers,
	the Postfix sendmail command produced output records longer
	than $line_length_limit, causing postdrop to reject the
	mail. Diagnosis by Victor Duchovni. File:  sendmail/sendmail.c.


	Cleanup: explicit Makefile targets for "make package" and
	"make non-interactive-package" to create ready-to-install
	packages for distribution to other systems. Added extra
	sanity checks to prevent attempts to overwrite your running
	Postfix instance. Files:  Makefile.in, proto/PACKAGE_README.

	Cleanup: when bounce_queue_lifetime > maximal_queue_lifetime,
	it is adjusted to maximal_queue_lifetime, and a warning is
	logged. Files:  *qmgr/qmgr.c.


	Cleanup: trivial-rewrite now restarts more timely after
	changes in lookup tables.  Of the all the alternatives
	tested, the simplest one produces the most bang for the
	buck. The other code is left in place for illustrative
	purposes. File:  trivial-rewrite/trivial-rewrite.c.

	Cleanup: sendmail no longer ignores null command-line
	recipients.  File: sendmail/sendmail.c.

	Cleanup: "postfix start" background checks moved back to
	the foreground so they can be stopped more easily.  File:


	Feature: REPLACE command in header/body_checks (implemented
	as a combination of PREPEND and IGNORE) by Bastiaan Bakker.
	File: cleanup/cleanup_message.c.

	Cleanup: linted the manual pages for consistency in the
	way manuals are referenced, and in the presentation of
	command examples. Files: mantools/manlint, mantools/fixman,


	Cleanup: updated the mass-deletion example in the postsuper


	Cleanup: don't count a [45]XX SMTP server greeting towards
	the mx_session_limit setting. File: smtp/smtp_connect.c.

	Feature: output address rewriting in the SMTP client. The
	smtp_generic_maps parameter specifies an address mapping
	that happens only when mail is delivered via SMTP. This is
	typically used for hosts without a valid domain name, that
	use something like localdomain.local instead.  This feature
	can replace local mail addresses by valid Internet mail
	addresses when mail needs to go across the Internet, but
	not when mail is sent between accounts on the local machine.
	Files:  smtp/smtp_proto.c, smtp/smtp_map11.c.

	Cleanup: don't panic in mymalloc() when master can't find
	any IP addresses. LaMont Jones. File: master/master_ent.c.


	Documentation: added a generic(5) manual page for consistency
	with the already existing table driven mechanisms, added
	references to or examples of the new generic mapping.

	Bugfix: the header_checks REPLACE action mis-handled
	multi-line replacement text in message headers, for example:
	/(.*)/ REPLACE X-$1. File:  cleanup/cleanup_message.c.

	Bugfix: the header_checks REPLACE action should not drop
	the input when the action is NOT executed. File:

	Bugfix? Cleanup? Documentation? main.cf now implements
	${name[?:]value} as promised in the postconf(5) manual.
	Implemented by deleting the macro processor in dict_eval(),
	and using the one in mac_expand() instead.  File: util/dict.c.


	Feature: check_ccert_access maptype:mapname for access(5)
	control, based on code by Victor Duchovni. File:
	smtpd/smtpd_check.c and documentation.

	Safety: don't allow unlimited message size with limited
	mailbox size. File: local/local.c, virtual/virtual.c.

	Feature: new smtpd policy attributes ccert_subject,
	ccert_issuer and ccert_fingerprint, with TLS client
	certificate information, but only when verification was
	successful.  Files:  src/smtpd/smtpd_check.c.

	Cleanup: corrected the address verification data flow in


	Cleanup: the smtp generic mapping did syntax check on the
	input address instead of the result. These tests were not
	going to be useful in any case, because mail_addr_map()
	canonicalizes the lookup result, including @dom1->@dom2
	mapping. File:  smtp_map11.c.

	Cleanup: made the generic mapping documentation consistent
	with the implementation.

	Cleanup: documented the myorigin/mydomain address rewriting
	in canonical, generic and virtual alias maps.

	Feature: updated LDAP and *SQL query interfaces using a
	common infrastructure so that all have the same feature set
	where possible. Victor Duchovni and many others. This code
	was tested separately and was merged into the main stream
	20050308. Files: global/db_common.[hc], global/dict_ldap.c,
	global/dict_mysql.c, global/dict_pgsql.c, plus documentation.


	Bugfix: spurious fallback_relay warnings after 20050202.
	Victor Duchovni.  File: smtp/smtp_connect.c.

	Bugfix: (introduced while adopting Postfix/TLS patch) the
	TLS cache scan stopped after expiring one entry.  Victor
	Duchovni.  File: tls/tls_scache.c.

	Safety: delete-behind when removing expired entries from
	TLS session caches. With some maps the enumeration method
	mis-behaves when the current entry is deleted. File:


	Cleanup: the "generics" feature (output address rewriting)
	is renamed to "generic", for consistency with "canonical"
	and "virtual".


	Cleanup: remove old trace(8) logfile before attempting
	delivery (and after locking the message file exclusively).
	Files: *qmgr/qmgr_message.c.

	Cleanup: don't parse-then-regenerate message headers when
	no address is changed by address rewriting operations. This
	behavior was copied from the SMTP client's generic mapping
	code.  Files: cleanup/cleanup_rewrite.c, cleanup/cleanup_map11.c,
	cleanup/cleanup_masquerade.c, cleanup/cleanup_message.c..


	Bugfix: don't chmod queue files while running "postfix
	set-permissions". This prevents mail from being labeled as
	"corrupt" when a live Postfix system is upgraded.  Found
	by Victor Duchovni.  File: conf/post-install.


	Feature: in smtpd?_discard_ehlo_keyword(s|_address_maps)
	specify the pseudo keyword "silent-discard" in order to
	avoid logging that some EHLO keyword is being suppressed.
	File: global/ehlo_mask.[hc].


	Bugfix: typo in tls_server.c, breaking CApath.  Fix by
	Philipp Morger. File: tls/tls_server.c.


	Bugfix (bug introduced 20040331): with SIGHUP ignored, the
	postdrop signal handler would effectively ignore SIGINT,
	SIGQUIT and SIGTERM.  Simplified the overly-conservative
	protection against nested signals in postdrop, and added
	some future proofing comments.  File:  postdrop/postdrop.c

	Cleanup: when address rewriting is enabled, don't change
	the capitalization of header labels, i.e. don't replace
	FROM: or CC: by From: or Cc:. Files: cleanup/cleanup_message.c,


	Cleanup/portability: missing #includes and bad prototypes.
	Matthias Andree, Carsten Hoeger, and others.


	Workaround: make TLS session caching work with perverse
	sites that have multiple servers per hostname or even
	multiple servers per IP address, but no shared TLS session
	cache. The SMTP client TLS session cache is now indexed by
	(server hostname, server address, server port, server helo
	hostname). After an idea by Victor Duchovni. Files:
	smtp/smtp_proto.c, tls/tls_client.c.


	Bugfix (bug inherited from Postfix/TLS patch): a rare 9kbyte
	memory leak when in-memory TLS session information expires;
	found by setting the expiry time shorter than the time to
	deliver one or two messages with a very slow machine.  This
	was due to a missing SSL_SESSION_free() call in the "new
	session" call-back routines. Found by Victor Duchovni.
	Files: tls/tls_client.c, tls/tls_server.c.

	Workaround: OpenSSL is overly agressive when purging a
	not-yet expired entry from a full in-memory cache: it also
	purges the entry from the on-disk server session cache.
	Workaround is to let only the tlsmgr purge entries from the
	on-disk server session cache.  Found by Victor Duchovni.
	File: tls/tls_server.c.


	Postfix releases are now signed with Wietse's new PGP key.
	The old key was getting a bit short for today's standards.
	The new public key can be found on the Postfix download
	webpage. As proof of authenticity the new PGP key is signed
	with Wietse's old PGP key.

	Cleanup: check_mumble_{ns,mx}_access no longer attempt to
	do MX or NS lookups for address literals. An address literal
	is treated as its own MX host; there is no meaningful
	equivalent for NS access control. File: smtpd/smtpd_check.c.


	Bugfix: the AIX and SUN compilers rightfully complained
	about non-portable code in the "new" LDAP/SQL client. File:

	Workaround: some systems no longer recognize "tail +2" as
	valid command syntax. Instead they require "improved" syntax
	that is not valid on several other systems that Postfix
	builds on.  So we have to stop using the tail command.
	Files: Makefile.in, src/*/Makefile.in.


	Bugfix: the TLS session cache cleaning code didn't always
	delete the right entry. Problem found by Victor Duchovni,
	more problems found by Wietse. File: tls/tls_scache.c.


	Portability: Berkeley DB changed API from version 2.5 to
	2.6. Rob Foehl. File: util/dict_db.c.


	Bugfix: when <unistd.h> is included, read is a reserved
	identifier. File: smtpstone/smtp-source.c.


	Support for RFC 3463 enhanced status codes.  See also the
	ENHANCED_STATUS_README (a hacker's guide) for background.

	New module to pass around (status code + text) instead of
	just text.  File: Files: global/dsn_util.c.

	Status-related lookup tables now have an extra column for
	enhanced status codes.  Files: global/sys_exits.c,

	Cleanup: centralized mapping of errno values to delivery
	status codes after failed delivery to mailbox, maildir, or
	file. Error codes EAGAIN, and ESTALE are 4.2.0 temporary
	errors; ENOSPC is a 4.3.0 temporary error; and EDQUOT and
	EFBIG are 5.2.2 hard errors. For backwards compatibility,
	the result of other errors depends on the delivery agent:
	with local(8) everything else is a 5.2.0 hard error, and
	with virtual(8) everything else is soft 4.2.0 error.  File:


	Workaround: gcc -W (version 3.4.2 [FreeBSD] 20040728) no
	longer warns about missing return statements. What a time

	Workaround: gcc -E (version 3.4.2 [FreeBSD] 20040728) output
	has changed, causing too much "make depend" output.


	Bugfix: when bouncing mail that was submitted with Postfix
	sendmail, the cleanup daemon ignored the reason specified
	in header/body_checks, and always produced a generic reason.
	File: cleanup/cleanup_api.c.

	Workaround: don't announce pipelining support when the
	smtp-sink test program is configured to fail specific
	commands with -r or -f (the fix is to build a proper SMTP
	state engine into the smtp-sink test program).  File:


	Update: more PCRE error codes. File: util/dict_pcre.c.


	Bugfix: the SMTP and LMTP clients did not ask the queue
	manager to reduce destination concurrency when "lost
	connection" or "connection timed out" happened AFTER Postfix
	received the server greeting. Files: smtp/smtp_trouble.c,

	Workaround: FreeBSD has incompatibly changed the output
	format from "od", breaking regression test portability.

	The TLS client session cache ID is now derived from the
	server IP address, TCP Port, and server HELO hostname
	if available. File: smtp/smtp_proto.c.


	Cleanup: the REPLACE action is no longer implemented as
	PREPEND+IGNORE. The result remains in the input stream,
	and is subject to address rewriting and other processing
	where applicable.  File: cleanup/cleanup_message.c.

	Feature: the TLS server name verification status is moved
	out of the TLS session cache. This not only simplifies the
	client-side TLS cache implementation, but also provides
	better cache support for clients that connect to multiple
	independent MTAs under the same DNS hostname or IP address,
	provided that each MTA replies with a unique name in the
	EHLO response. Patch by Victor Duchovni. Files: tlsmgr/tlsmgr.c,
	tls/tls_verify.c, tls/tls_session.c, tls/tls_server.c,
	tls/tls_scache.h, tls/tls_scache.c, tls/tls_misc.c,
	tls/tls_mgr.h, tls/tls_mgr.c, tls/tls_client.c, tls/tls.h,


	Bugfix: in some compilation environments the SMTP and LMTP
	clients could ignore enhanced status codes in server replies.
	Bug introduced 20050329 while polishing working code.  Files:
	smtp/smtp_chat.c, lmtp/lmtp_chat.c.

	Feature: add enhanced status code support to the smtp-sink
	test program. File: smtpstone/smtp-sink.c.


	Workarounds for ancient gcc compilers that can't handle
	valid C. Bugs reported by Victor Duchovni. Files:
	util/sys_defs.h, global/dsn_util.h, tls/tls_client.c.

	Bugfix: when delivery to command failed, command output was
	not reported. Fix was to enable format checks for the new
	dsn_vstring_update() module. File: global/dsn_util.h,


	Cleanup: ignore incorrect enhanced status codes (such as
	5xx reply followed by a 4.x.x status), and don't look for
	enhanced status codes unless the server replies with a
	[245]XX reply.  Files: smtp/smtp_chat.c, lmtp/lmtp_chat.c.


	Feature: enhanced status code support for errors found by
	the MIME processor. Files: global/mime_state.c,
	cleanup/cleanup_message.c, smtp/smtp_proto.c.

	Cleanup: updated error messages about MIME processing errors
	in the SMTP client. These errors are no longer specific to
	8bit->7bit conversion; they can also happen with generic
	address mapping. File: smtp/smtp_proto.c.

	Safety: SASL 2.1.19 has a version lookup routine that we
	can use to detect compile time / run time version mis-matches
	(also known as DLL hell).  Files: src/smtpd/smtpd_sasl_glue.c,
	src/smtp/smtp_sasl_glue.c, src/lmtp/lmtp_sasl_glue.c.


	Typo: missing comma after dsn=x.yy.zz logging. File:

	Feature: specify "smtpd_sasl_authenticated_header = yes"
	to report the SASL login name in the Received: message
	header, so that the login name is shared with the whole
	world. Based on code by Branko F. Gracnar. Files:
	smtpd/smtpd.c, and documentation.


	@%^!#& Thanks to inadequate SASL documentation the client
	could negotiate a security layer where none was desired.
	Better documentation has become available since Postfix
	SASL support was implemented, and now Postfix needs to be
	fixed. Files: */*_sasl_glue.c.


	Safety: the CDB map now logs a warning when the source file
	is newer than the indexed file, just like the Berkeley DB
	and DBM maps. Michael Tokarev. File: util/dict_cdb.c.


	Portability: put the SASL DLL Hell guard after the declarations
	instead of before.  Reported by Marcus Grando. Files:
	smtp/smtp_sasl_glue.c, lmtp/lmtp_sasl_glue.c.


	Infrastructure: change the disposition or other properties
	of an embryonic queue file. This is currently used only to
	place mail on hold.  After code by Victor Duchovni.  Files:
	global/mail_stream.[hc], cleanup/cleanup_api.c.

	Bugfix: while updating the cleanup_flush() infrastructure
	eliminated a portability problem that was introduced when
	"REJECT text" support was added. File: cleanup/cleanup.c.

	Portability: don't mix socket message send/receive calls
	with socket stream read/write calls. The fact that you can
	get away with it only on some stacks implies that there is
	no long-term guarantee. Specify -DCAN_WRITE_BEFORE_SENDING_FD
	if you feel brave. File: util/sys_defs.h.

	Robustness: re-compile all object files after the "make
	makefiles" options have changed. Files: src/*/Makefile.in.

	Tweaking: reply with 5.3.4 when the message size exceeds
	the mail system message_size_limit, instead of 5.2.3 which
	is a mailbox specific status. File: smtpd/smtpd_check.c.


	Safety: don't call syslog from a user-triggered signal
	handler.  File: postdrop/postdrop.c.


	Bugfix: don't panic when the fall-back relay can't be used
	because the local MTA is MX for the destination.  File:


	Bugfix: don't panic when the fall-back relay can't be used
	because it was already tried via a cached session. Produce
	a default excuse instead. File: smtp/smtp_connect.c.

	Bugfix: postsuper could lose an error message after reporting
	a fatal error.  File: postsuper/postsuper.c.


	Bugfix: simplified and improved the 20050422 fall-back relay
	fix. File: smtp/smtp_connect.c.


	Final solution for the 20050422 fall-back relay problem:
	truncate the fall-back host list when the local MTA is MX
	for some destination. Files: util/argv.c, smtp/smtp_connect.c.

	Cleanup: extra dsn_vstring_update_dsn() routine to shut up
	GCC complaints about valid code. Files: src/global/dsn_util.c,
	src/global/mbox_open.c, src/lmtp/lmtp_addr.c, src/smtp/smtp_addr.c,


	The Postfix SMTP server now announces ENHANCEDSTATUSCODES
	support in the EHLO response, as described in RFC 2034.
	File: smtpd/smtpd.c.


	Propagate enhanced status code from error(8) mailer to SMTP
	server replies. File: smtpd/smtpd_check.c.

	Cleanup: more consistent format of smtpd warning logging,
	so that it is easier to sort.  Files: smtpd/smtpd.c,


	Yikes. People are exposing the smtp-sink test program to
	hostile environments, while it was designed for controlled
	environments. Completed the support for write timeouts,
	added support for read timeouts, and added a missing exception
	handler for the 220 server greeting.  File: smtpstone/smtp-sink.c.


	Cleanup: with "REJECT 4.X.Y ..." actions in header/body_checks,
	change the SMTP server reply code from 550 into 450, instead
	of having the SMTP server change the DSN into 5.X.Y.  File:


	Usability: when reporting a sender address problem, transform
	a recipient DSN status (e.g., 4.1.1-4.1.6) into the
	corresponding sender DSN status, and vice versa; and when
	reporting a non-address problem, transform a sender or
	recipient DSN status into a generic non-address DSN status
	(e.g., 4.0.0).  This transformation may be needed when the
	same access table or RBL reply template are used for client,
	helo, sender, or recipient restrictions; or when the same
	error mailer information is used for senders or recipients.
	Files: smtpd/smtpd_check.c, smtpd/smtpd_dsn_fix.[hc].


	Feature: support for more SASL logging call-backs, if these
	are defined in the compile-time environment. Files:
	smtpd/smtpd_sasl_glue.c, smtp/smtp_sasl_glue.c.


	Workaround: Postfix now uses "localdomain" as the default
	domain name when $myhostname is not in "host.domain" form.
	Files: global/mail_params.[hc].



	As of 20050525, DSN support does not involve new queue file
	record types, so you can switch back to older Postfix
	versions. Older non-production releases did introduce queue
	file incompatibilty.

	DSN support is selected via the SMTP port by extra parameters
	to the MAIL FROM and RCPT TO commands, and with the Postfix
	sendmail command with new command-line options: -N (specify
	notification options such as "never", "success", "delay"
	or "failure") and -V (specify an envelope ID that identifies
	the mail submission transaction).  VERP support now uses
	-XV instead of -V.

	The implementation piggy-backs on the trace(8) service that
	was already used for "sendmail -v" (verbose delivery) and
	for "sendmail -bv" (what-if) reports. You can no longer
	requests these functions together with DSN support.

	All this means revision of bounce/defer/trace client
	interfaces, of the bounce service, the record reading loops
	in postdrop, cleanup(8) and qmgr(8), the queue manager to
	delivery agent protocol, and some extra SMTP protocol
	parameters in smtpd(8), lmtp(8) and smtp(8).

	New code module: global/dsn_smtp.[hc] for RFC 3461 related
	information (but this may still change).

	Feature: "sendmail -G" is no longer a no-op.  Message headers
	are treated as if the message has a remote origin. Files:
	sendmail/sendmail.c, postdrop/postdrop.c.

	Feature: automatic BCC senders are now created as if they
	were received with NOTIFY=NEVER, in case it helps. File:

	Compatibility: with large bounces, send message headers
	only, instead of truncating MIME messages in the middle.


	Bugfix: in a DSN report, the original recipient should not
	be xtext encoded. File: bounce/bounce_notify_util.c.


	Bugfix: mymalloc() panic with mistyped server host list.
	File: global/dict_pgsql.c.


	Feature: specify delay_warning_time=1 to get immediate
	notification of delay. File: qmgr/qmgr_active.c.


	Reset the Postfix original recipient when delivering to
	mailing list.


	Modified the master backgrounding procedure to not abort
	when the master is already a process group leader. This
	happens when people bypass or modify the official Postfix
	start-up procedure.  Jacek Konieczny. File: master/master.c.


	Sanity check: don't report "address in use" when some Postfix
	socket is a directory. File: util/unix_listen.c.


	Now that the over-all structure of the code is proving
	itself, interfaces can be cleaned up. This means nicer names
	for variables, functions and data structures, and dedicated
	read/write routines for recipient and DSN information.
	These remove a lot of clutter from the bounce client and
	server code.  Files: dsn_print.c dsb_scan.c, rcpt_print.c,

	For Sendmail compatibility, the Postfix sendmail -V option
	no longer controls VERP usage, but is used to specify the
	DSN envelope ID.  In order to provide a smooth transition,
	backwards compatibility code recognizes when -V is being
	used for VERP control.  It will do the right thing, and
	warns the user to use -XV instead. File: sendmail/sendmail.c.


	The cleanup server writes bounce (delivery failure) and
	trace (success) records, but it no longer requests sender
	notification.  That is now handled by the queue manager.
	The reason is that the cleanup server must be able to abort
	a request including its bounce and trace logfiles, so it
	must not take actions that can't be undone.


	Cleanup: the SMTP client now sends QUIT when the initial
	HELO handshake fails. it still doesn't send QUIT when the
	server greets with a [45]XX code, as that is handled in the
	connection management code before a session context exists.
	File: smtp/smtp_connect.c.

	Cleanup: made the quote_821_local() routine "const" clean.
	File: global/quote_821_local.[hc].


	Bugfix: missing or mis-placed va_end() macros, found in
	Postfix 2.3 code review. Files: util/netstring.c,
	util/myaddrinfo.c, util/attr_clnt.c, util/vstream.c.

	Bugfix: the SMTP server now separates the message size check
	from the queue space check, so that the size check can be
	done before an SMTPD proxy filter. Files: smtpd/smtpd.c,


	Postdrop didn't recognize the new recipient attributes.
	File: postdrop/postdrop.c.

	Feature: configurable MAILER-DAEMON replacement for the
	null sender address that is used by the pipe(8) delivery
	agent on the command line and in message headers. Command-line
	address quoting is disabled when the replacement is empty.
	File: pipe/pipe.c.


	With virtual aliasing enabled, Postfix would always report
	successful alias expansion, even when no alias was expanded.
	File: cleanup/cleanup_out_recipient.c.


	Portability: file descriptor passing is available for Tru64
	UNIX, but not for AIX4 and IRIX6.  Albert Chin. File:


	Cleanup: the DNS lookup code now accommodates name server
	replies longer than 4 kbytes, with a hard upper limit of
	32kbytes. For safety reasons, the number of MX host addresses
	that the SMTP client will try was reduced from unlimited
	to just 5, so that Postfix won't spend forever trying to
	connect to dozens and dozens of bogus MX hosts. Files:
	dns/dns_lookup.c, global/mail_params.h.

	Cleanup: the code that handles a 4xx or 5xx SMTP server
	greeting was moved from the connection management module
	to the protocol engine, for cleaner error handling.  This
	means that the failed session now counts towards the limit
	on the total number of SMTP sessions per domain name (default:
	smtp_mx_session_limit = 2).  Files: smtp/smtp_connect.c,


	Cleanup: generalized the delegated attribute scan/print
	interfaces, and updated the deliver_pass module with delegated
	attribute scan/print support. Files: util/attr_scan0.c,
	util/attr_print0.c, global/dsb_scan.c, global/dsn_print.c,
	global/rcpt_buf,c global/rcpt_print.c, global/deliver_pass.c.

	Added delegated attribute scan/print function support to
	the base64 and plain attribute I/O encodings. Files:
	util/attr_scan_plain.c util/attr_print_plain.c.


	Added "." to the list commands that smtp-sink can "break"
	(by disconnecting, or by responding with a 4XX or 5XX reply
	code). File: smtpstone/smtp-sink.c.


	Safety: allow only 4.x.x and 5.x.x enhanced status codes
	in header/body_checks REJECT actions. File:


	Code cleanup: generalized the smtp-sink code that simulates
	server errors. File: smtpstone/smtp-sink.c.


	Code cleanup: the smtp_mx_session_limit setting (per delivery
	request session count limit) now ignores sessions that fail
	to complete the TCP, SMTP, EHLO or TLS handshake (was: TCP
	and SMTP).  File: smtp/smtp_proto.c.


	Updated the example spf.pl script to version 1.06.

	Portability: the file descriptor passing code broke on LP64
	systems (inherited from Stevens Network Programming).  Files:
	util/unix_send_fd.c, util/unix_recv_fd.c.


	Robustness: the SMTP client now disables connection caching
	when it is unable to communicate with the scache(8) server,
	instead of looping forever. File: global/scache_clnt.c.

	Portability: after sending a socket, the scache(8) server
	now waits for an ACK from the connection cache client before
	closing the socket that it just sent. Files: scache/scache.c,

	Bugfix: missing returns in 20050706 caching disabling code
	(in error handling code that never executes).  File:

	Portability: use explicitly unsigned operands when doing
	bit-wise shift operations on data larger than a character.


	Migration of data object sizes and offsets from int->ssize_t
	and unsigned->size_t for better portability to LP64 and
	LLP64 systems where *size_t is 64 bits wide.   This change
	has no effect on 32-bit systems.

	This change not only eliminated some obscure portability
	bugs (see two paragraphs down), it also eliminated many
	unnecessary conversions back and forth between 32-bit and
	64-bit integers, because all relevant system library functions
	take *size_t arguments or return *size_t results.

	Simply changing every data object size or offset to size_t
	(which is unsigned!) would be dangerous.  A lot of code was
	written assuming signed arithmetic and rejects negative
	lengths, which can happen as the result of integer overflow.

	Portability: on LP64 systems, integer expressions are int,
	but sizeof() and pointer difference expressions are larger.
	The above changes fixed a few discrepancies with function
	calls where *size_t was passed while the old code expected
	an int: clean_env() versus argv_addn(), and code that sent
	binary blobs via the TLS session cache manager protocol.


	Bugfix: don't include <> when auto-generating an ORCPT
	address from a client RCPT TO command. File: smtpd.c.


	Cleanup: cleanup_out_recipient() still generated DSN records
	that were incompatible with pre-DSN Postfix versions.  File:


	Bugfix: the smtpd_sasl_authenticated_header code did not
	check if SASL was actually enabled. File: smtpd/smtpd.c.


	Feature: reverse client hostname. This is set at connection
	time with information from the SMTP client address->name
	mapping, and can be overruled with the REVERSE_NAME attribute
	in the XCLIENT command. File: smtpd/smtpd_peer.c.

	Cleanup: renaming of several confusing restriction names:
	reject_unknown_client -> reject_unknown_client_hostname,
	reject_unknown_hostname -> reject_unknown_helo_hostname,
	reject_invalid_hostname -> reject_invalid_helo_hostname,
	and reject_non_fqdn_hostname -> reject_non_fqdn_helo_hostname.
	The old names are still recognized and documented.  Files:
	global/mail_params.h, smtpd/smtpd.c, smtpd/smtpd_check.c.

	Feature: reject_unknown_reverse_client_hostname. This rejects
	clients that have no address to name mapping (unlike the
	reject_unknown_client_hostname feature which requires that
	the address->name and name->address mappings resolve to the
	client IP address).  Files: global/mail_params.h,
	smtpd/smtpd_peer.c, smtpd/smtpd.c, smtpd/smtpd_check.c.


	Horror: total rewrite of DNS client error handling because
	some misguided proposal attempts to give special meaning
	to some syntactically invalid MX hostname lookup result.
	Not only that, people expect sensible results with
	reject_unknown_sender_domain etc.  Files: dns/dns_lookup.c,
	smtp/smtp_addr.c smtpd/smtpd_check.c, lmtp/lmtp_addr.c.

	Cleanup: HOLD action executes only once, to reduce noise
	in the logfile. Files: cleanup/cleanup_message.c, smtpd/smtpd.c.


	Workaround: accept(2) fails with EPROTO when the client
	already disconnected (SunOS 5.5.1). File: sane_accept.c.


	Workaround: old Solaris compilers can't link an archive
	without globally visible symbols. File: tls/tls_misc.c.


	Feature: message_reject_characters and message_strip_characters
	specify what characters in message content Postfix will
	reject or remove. Based on patch by John Fawcett. Files:
	cleanup/cleanup_message.c, cleanup/cleanup_init.c.

	Safety: when the cleanup server rejects the content of mail
	that is submitted with the Postfix sendmail command, or
	re-queued with "postsuper -r", strip the message body from
	the bounce message to reduce the risks from harmful content.
	Files: cleanup/cleanup_envelope.c, cleanup/cleanup_bounce.c.

	Feature: the smtpd_proxy_filter parameter value can now be
	prefixed with "unix:" (for UNIX-domain socket) and "inet:"
	(for TCP socket). TCP sockets are the default.  Patch by
	Edwin Kremer. File: smtpd/smtpd_proxy.c.


	Bugfix: after adding DSN support, error notification was
	broken for too large mail that was submitted with the Postfix
	sendmail command, forwarded by the local(8) delivery agent,
	or re-queued with "postsuper -r". The message would be saved
	to the "corrupt" queue.

	The mistake was to leave the truncated message in the
	incoming queue and to ask the queue manager to notify the
	sender; this was not possible because the queue manager
	cannot (and should not) handle truncated queue files.

	The fix is to have the cleanup server send the bounce
	message, just like it did before DSN support was added.  As
	a side effect, Postfix will no longer send DSN_SUCCESS
	notices after virtual aliasing, when the cleanup server
	bounces all the recipients of the message anyway.  This
	could be called a feature.  File: cleanup/cleanup_bounce.c.

	Also needed for this fix: a new vstream_fpurge() routine
	that discards unread/written data from a VSTREAM.  It's
	needed before cleanup_bounce() can seek to the start of the
	queue file after a file size error. File: util/vstream.c.


	Cleanup: removed the legacy "tls_info" structure, factored
	out common code for peer_CN and issuer_CN lookup, and added
	sanity check to not verify subject common names that contain
	nulls or that are execessively long. Patch by Victor Duchovni.
	Files: tls_client.c, tls_server.c, tls_session.c, tls_misc.c,

	Bugfix: the *SQL clients did not uniformly choose the
	database host from the available pool of servers due to an
	off-by-one error, so that the "last" available server was
	not selected. Leandro Santi. Files: dict_mysql.c, dict_pgsql.c.

	Update: common code factored out into db_common.c, and
	adoption of Liviu Daia's connection aware MySQL quoting.
	Patch by Victor Duchovni.  Files: dict_ldap.c, dict_mysql.c,
	dict_pgsql.c, db_common.c.


	Safety: don't update the local(8) delivery agent's idea of
	the Delivered-To: address while expanding aliases or .forward
	files. When an alias or .forward file changes the Delivered-To:
	address, it ties up one queue file and one cleanup process
	instance while mail is being forwarded.  To get the old
	behavior, specify "frozen_delivered_to = no".  Problem
	reported by Michael Tokarev, but found independently by
	others.  Files: local/local.c, local/aliases.c, local/dotforward.c,
	local/mailbox.c, local/maildir.c.

	Logging: additional SASL debug logging by Andreas Winkelmann.
	Files: */*sasl_glue.c.


	Paranoia: don't ignore garbage in SMTP or LMTP server replies
	when ESMTP command pipelining is turned on. For example,
	after sending ".<CR><LF>QUIT<CR><LF>", Postfix could recognize
	the server's 2XX QUIT reply as a 2XX END-OF-DATA reply after
	garbage, causing mail to be lost. The SMTP and LMTP clients
	now report a remote protocol error and defer delivery.
	Files: smtp/smtp_chat.c, smtp/smtp_trouble.c, lmtp/lmtp_chat.c,

	Performance: specify "smtpd_peername_lookup = no" to disable
	client hostname lookups in the SMTP server. All clients are
	treated as "unknown". This should be used only under extreme
	conditions where DNS lookup latencies are critical. File:


	Feature: smtpd_client_new_tls_session_rate_limit parameter
	to limit the number of new (i.e. uncached) TLS sessions
	that a remote SMTP client may negotiate per unit time. This
	feature, which is off by default, can limit the CPU load
	due to expensive crypto operations.  Files: global/anvil_clnt.c,
	anvil/anvil.c, smtpd/smtpd.c.

	Cleanup: eliminated massive code duplication in the anvil
	server that resulted from adding similar features one at a
	time.  File: anvil/anvil.c.


	Bugfix: raise the "policy violation" flag when a client
	request exceeds a concurrency or rate limit.  File:

	Bugfix (cut-and-paste error): don't reply with 421 (too
	many MAIL FROM or RCPT TO commands) when we aren't closing
	the connection.  File: smtpd/smtpd.c.


	Polishing: content of comments and sequence of code blocks
	in the anvil server, TLS request rate error message in the
	smtp server, and documentation, but no changes in code.
	Files: anvil/anvil.c, smtpd/smtpd.c.

	Horror: some systems have basename() and dirname() and some
	don't; some implementations modify their input and some
	don't; and some implementations use a private buffer that
	is overwritten upon the next call. Postfix will use its own
	safer versions called sane_basename() and sane_dirname().
	These never modify the input, and allow the caller to control
	how memory is allocated for the result.  File:

	Feature: "sendmail -C path-to-main.cf" and "sendmail -C
	config_directory" now do what one would expect. File:

	Bugfix: don't do smtpd_end_of_data_restrictions after the
	transaction failed due to, e.g., a write error.  File:

	Cleanup: the SMTP server now enforces the message_size_limit
	even when the client did not send SIZE information with the
	MAIL FROM command.  This protects before-queue content
	filters against over-size messages.  File: smtpd/smtpd.c.


	Bugfix: after DSN support was added, smtp_skip_5xx_greeting
	no longer recognized a 5xx SMTP status as a 4xx one. Found
	by Ralf Hildebrandt. Fix: use the enhanced status code
	instead of the SMTP reply code to choose between permanent
	or transient errors. File: smtp/smtp_trouble.c.

	Feature: smtp-sink can hard-reject, soft-reject or simply
	drop connection requests.  File: smtpstone/smtp-sink.c.

	Documentation: clarified the processing of server replies,
	specifically the reply code and the enhanced status code,
	in smtp_chat.c.


	Performance: new smtp_connection_reuse_time_limit parameter to
	limit connection reuse by elapsed time, instead of limiting
	the number of deliveries per connection.  Bounding by time
	favors delivery over connections that perform well, while
	bounding by number of deliveries allows slow connections
	to drag down the performance.  Insight and initial
	implementation by Victor Duchovni, Morgan Stanley. Files:
	smtp_connect.c, smtp_session.c,

	Bugfix: the next-hop logical destination information for
	connection caching was reset only after a good non-TLS
	connection, so that cached connections to non-TLS backup
	servers could suck away traffic from TLS primary servers
	(the Postfix SMTP client cannot cache an open TLS connection).
	Found during code review. This is fixed with multi-valued
	connection caching state: expired, cachable, non-cachable,
	and bad.  Files: smtp_connect.c, smtp_trouble.c.

	Bugfix: adding support for "sendmail -C" broke "sendmail
	-q".  File: sendmail/sendmail.c.


	Migration from a single "arrival time" stamp to a structure
	with time stamps from different stages of message delivery.
	The first iteration merely replaces "arrival time" stamps
	by a structure or pointer to structure, and uses only the
	arrival time field of that structure.  This is an extensive
	but straightforward transformation, based on example by
	Victor Duchovni, Morgan Stanley.  Files: anything that
	invokes bounce_append etc., the log_adhoc module, and
	anything that sends or receives a delivery request.


	Completion of support for time stamps from different stages
	of message delivery. The information is now logged as
	"delays=a/b/c/d" where a=time before queue manager, including
	message transmission; b=time in queue manager; c=connection
	setup including DNS, HELO and TLS; d=message transmission
	time. Unlike Victor's example which used time differences,
	this implementation uses absolute times. The decision of
	what numbers to subtract actually depends on program history,
	so we want to do it in one place.  Files: global/log_adhoc.c,
	smtp/smtp_connect.c, smtp/smtp_proto.c, smtp/smtp_trouble.c,
	lmtp/lmtp_proto.c, lmtp/lmtp_trouble.c.


	Refinement of time stamping and delays formatting.  The
	hand-off time is now stamped in the delivery agent, so that
	time is properly attributed when a transport is saturated
	or throttled.  Delays are now logged if larger than 0.01
	second. Files: *qmgr/qmgr_deliver.c, global/deliver_request.c,


	New parameter delay_logging_time_resolution (default: 10000
	microseconds, or 0.01 second) that controls the detail in
	the new "delays=a/b/c/d" logging. Specify a power of 10
	in the range from 1 to 100000. File: global/log_adhoc.c.
	Parameter renamed 20051108.


	All delay logging now has sub-second resolution. This means
	updating all code that reads or updates the records that
	specify when mail arrived, and ensuring that mail submitted
	with older Postfix versions produces sensible results.
	Files: global/post_mail.c, global/mail_timeofday.[hc],
	global/log_adhoc.c, postdrop/postdrop.c, pickup/pickup.c,
	cleanup/cleanup_envelope.c, cleanup/cleanup_message.c,
	smtpd/smtpd.c, qmqpd/qmqpd.c, *qmgr/qmgr_message.c,
	*qmgr/qmgr_active.c, local/forward.c.


	The SMTP client logs the remote server port in the form of
	relay=hostname[hostaddr]:port to the local maillog file.
	The port number is NOT included in DSN status reports,
	because remote users have no need to know such internal
	information.  Files: smtp/smtp_session.c, smtp/smtp_proto.c,

	Cleanup: encapsulated queue file time read/write operations
	with a few simple macros, to make future changes in time
	representation less painful.


	Cleanup: eliminated floating point operations from the
	ad-hoc delay logging code. Files: util/format_tv.[hc],

	The delay logging resolution is now controlled with the
	delay_logging_resolution_limit parameter, which specifies
	the maximal number of digits after the decimal point.

	Bugfix: two messages could get the same message ID due to
	a race condition. This time window was increased when queue
	file creation was postponed from MAIL FROM until the first
	accepted RCPT TO.  The window is closed again. Found by
	Victor. Files: global/mail_stream.c, global/mail_queue.c,


	qshape.pl updated for extra microsecond time field in Postfix
	queue files.

	Cleanup: removed obsolete code that handles rejected/dropped
	connections before the HELO handshake. File: smtp/smtp_connect.c.

	Bugfix: XCLIENT broke when reverse hostname support was added.
	Fix by Tomoyuki Sakurai. File: smtpd/smtpd.c.


	Workaround: don't set the delay warning timer for messages
	from inside or from outside that have the null sender as
	recipient. This was a waste of time, because the warning
	would always be discarded.  File: cleanup/cleanup_envelope.c.

	Feature: the built-in mail delivery status notification
	text is now implemented by built-in templates. Files:
	bounce/bounce_template.c, bounce/bounce_notify_util.c.


	Feature: configurable bounce message templates based on
	contribution by Nicolas Riendeau. I kept the general format
	of his templates, but placed them together in one file to
	reduce process initialization overhead (most requests to
	the bounce daemon are not for sending bounce messages).
	Files: bounce/bounce_template.c, bounce/dict_ml.c (to be
	moved to library if useful enough). A sample bounce message
	template file is installed as $config_directory/bounce.cf.default.


	Feature: "postconf -b filename" to preview the non-default
	bounce message templates with $name expansions in the text.
	The actual work is of course done by the bounce daemon.


	Feature: -V option to make Postfix daemons to log to stderr.
	This is used when a daemon is invoked in stand-alone mode
	by a (non-daemon) command.

	Feature: "postconf -t" displays DSN templates, headers and
	all; use postconf -t ''" to view built-ins.

	Cleanup: renamed fail_template into failure_template.


	Cleanup: bounce template code reorg, no functionality change.
	Files: bounce/bounce_template.[hc], bounce/bounce_templates.c,


	Bugfix: new bounce template code did not return after
	template syntax error. File: bounce/bounce_template.c

	Safety: permit_mx_backup now requires that the local MTA
	is not listed as primary MX for the recipient domain. This
	prevents mail loops when someone points the primary MX
	record to Postfix.


	Workaround: some SMTP servers announce multiple but different
	lists of SASL methods. Postfix now concatenates the lists
	instead of logging a warning and remembering only one. File:

	Bugfix: the queue manager did not write a per-recipient
	defer logfile record when the delivery agent crashed between
	receiving a delivery request, and reporting the delivery
	status to the queue manager.  Found while redesigning the
	code that handles unavailable transports or destinations.
	Files: *qmgr/qmgr_deliver.c.


	Workaround: do not build the bounce.cf.default template
	while compiling Postfix  - it breaks when the default
	mail_owner etc. accounts don't exist.  Reported by Liviu

	Compatibility: added permit_auth_destination emulation to
	the permit_mx_backup feature. This avoids surprises with
	sites that used permit_mx_backup to authorize all their
	incoming mail.


	Feature: sender_dependent_relayhost_maps, lookup tables that specify
	a sender-dependent override for the relayhost parameter
	setting.  The lookup is done in the trivial-rewrite server,
	instead of the queue manager where it does not belong.
	Files: global/resolve_clnt.c, global/tok822_resolve.c,
	trivial-rewrite/resolve.c, trivial-rewrite/transport.c,

	Also: address_verify_sender_dependent_relayhost_maps for


	Feature: specify "smtp_sender_dependent_authentication =
	yes" to enable sender-dependent SASL passwords. This disables
	SMTP connection caching to ensure that mail from different
	senders is delivered with the appropriate credentials. This
	is an extended version of a patch by Mathias Hasselmann.
	Files: smtp/smtp_connect.c, smtp/smtp_sasl_glue.c.


	Workaround: log warning when REDIRECT or FILTER are used
	in smtpd_end_of_data_restrictions. File: smtpd/smtpd_check.c.

	Log warning when REDIRECT, FILTER, HOLD and DISCARD are
	used in smtpd_etrn_restrictions. File: smtpd/smtpd_check.c.


	Bugfix: moved code around from one place to another to make
	REDIRECT, FILTER, HOLD and DISCARD access(5) table actions
	work in smtpd_end_of_data_restrictions.  PREPEND will not
	be fixed; it must be specified before the message content
	is received.  Files: smtpd/smtpd.c, smtpd/smtpd_check.c,
	cleanup/cleanup_extracted.c, pickup/pickup.c.

	Safety: abort if the SMTP or QMQP server runs with non-postfix
	privileges while it's connected to the network.  Files:
	smtpd/smtpd_peer.c, qmqpd/qmqpd_peer.c.


	Bugfix: the LMTP client would reuse a session after negative
	reply to the RSET command (which may happen when client and
	server somehow get out of sync). Problem found by Christian
	Theune.  Files: lmtp/lmtp.c, lmtp/lmtp_proto.c.


	Bugfix: the 20051128 code move for "smtpd_end_of_data_restrictions"
	broke "postsuper -r".


	Cleanup: the SMTP client now also implements the LMTP
	protocol.  Files: smtp/smtp.c, smtp/smtp_connect.c,
	smtp/smtp_proto.c, smtp/smtp_dsn.c, smtp_state.c,

	As before, the LMTP behavior is controlled with parameters
	named lmtp_xxx instead of smtp_xxx.  However there are now
	a lot more lmtp_xxx parameters :-) With few exceptions, all
	SMTP features are now also available with LMTP. The exceptions
	are related to the HELO and EHLO commands, which exist in
	SMTP only. There are equivalent LHLO command parameters
	where it makes sense.


	SMTP+LMTP client connection management code rewritten to
	support UNIX-domain socket connections.


	Bugfix: race condition in the connection caching protocol,
	found while adding connection caching for UNIX-domain sockets
	(used for LMTP delivery).  This was introduced with the
	20050706 workaround, and may the same problem that Jussi
	Silvennoinen experienced (in Postfix 2.2.6) with SMTP after
	an upgrade.  Files: scache/scache.c.

	Bugfix: smtp-sink and qmqp-sink didn't ignore SIGPIPE.


	Robustness: reduced timeouts in the connection caching
	client, so that a malfunctioning service does not prevent
	mail delivery. This uses similar code that already exists
	for the anvil(8) client and the tlsmgr(8) client. Files:
	global/scache_clnt.c, smtp/smtp.c.

	To make reduced connection caching client timeouts possible,
	connection management was moved from the attr_clnt(3) module
	to the auto_clnt(3) module where it belongs. The auto_clnt(3)
	module is now a full alternative for the clnt_stream(3)
	module. Files: util/auto_clnt.c, util/attr_clnt.c.

	Bugfix: the best_mx_transport, mailbox_transport and
	fallback_transport features did not write a per-recipient
	defer logfile record when the target delivery agent was
	broken.  This the analog of queue manager bugfix 20051119.
	Files: global/deliver_pass.c.

	Cleanup: simplified the SMTP/LMTP connection management
	logic for address list and fallback relay processing.
	Still need to simplify deferred recipient handling.


	Bugfix: after a failed TLS session, the 20051210 SMTP client
	code cleanup broke sessions with backup servers, causing the
	client to get out of step with the backup server.  This in
	turn exposed a one-year old missing exception handling
	context in the EHLO handstake after sending STARTTLS. Victim
	was Ralf Hildebrandt, detectives Victor Duchovni and Wietse.
	File: smtp/smtp_proto.c.


	Bugfix: *SQL, proxy and LDAP map types were not defined in
	user-land commands such as postqueue. Leandro Santi. File:


	Server-side plug-in interface for SASL authentication. This
	uses Cyrus SASL by default, so nothing has changed except
	error messages may be more informative.  Files:
	smtpd/smtpd_sasl_proto.c smtpd/smtpd_sasl_glue.c,
	xsasl/xsasl_server.[hc], xsasl/cyrus_server.[hc]
	xsasl/cyrus_strerror.c, xsasl/cyrus_log.c, xsasl/cyrus_security.c.


	Portability: IRIX 6.5.28 defines sa_len as a macro, so it
	can't be used as a variable identifier. Zach McDanel. Files:
	dns/dns_rr_to_sa.c, smtpd/smtpd_peer.c, qmqpd/qmqpd_peer.c.


	Cleanup: removed some scar tissue that was introduced with
	server-side SASL plug-in support. Files: smtpd_sasl_proto.c,

	Client-side plug-in interface for SASL authentication. This
	uses Cyrus SASL by default, so nothing has changed except
	error messages may be more informative.  Files: smtp_sasl_glue.c,
	xsasl/xsasl_client.[hc], xsasl/cyrus_client.[hc].


	Bugfix: when a SASL client password is required by a specific
	server, defer delivery when no server-announced mechanism
	survives the smtp_sasl_mechanism_filter, instead of ignoring
	the SASL announcement and trying to deliver the mail over
	an unauthenticated connection and risking that mail will
	be rejected.  File: smtp/smtp_sasl_proto.c, smtp/smtp_proto.c.

	Portability: zero the "struct msg" just in case. Both purify
	(Linux) and valgrind (FreeBSD) complain about uninitialized
	bits.  Files: util/unix_{send,recv}_fd.c.


	Cleanup: generic smtpd_sasl_path, smtp_sasl_path and
	lmtp_sasl_path configuration parameters; simplified the
	SASL plug-in API, and made initial provisions for SASL
	session encryption. Files: xsasl/*.[hc].

	Feature: "postconf -a" lists the available SASL server
	plug-in types, and "postconf -A" does the same for the
	client.  Files: postconf.c, xsasl_{client,server}.c.

	Feature: new SMTPD policy attributes "encryption_protocol",
	"encryption_cipher" and "encryption_keysize", to distinguish
	plaintext from encrypted connections.


	Privacy: the new Cyrus SASL server plug-in replaces "no
	user" errors by "authentication failed" errors.  File:

	Safety: the Postfix SMTP client no longer uses CNAME expanded
	hostnames for logging, SASL password lookup, TLS policy
	decisions, or TLS certificate verification.  Instead it
	uses the name of the recipient domain, or the host or domain
	name specified in Postfix configuration files. Of course
	this won't prevent cheating with hostnames that appear in
	MX lookup results. To avoid that you will have to suppress
	MX lookups with explicit [hostname] entries in transport
	maps. Files: dns/dns_lookup.c, dns/dns_rr.c.


	Feature: Dovecot SASL authentication (server side) plug-in
	by Timo Sirainen. This builds without external library
	dependencies and is therefore compiled in by default.
	Files: xsasl/xsasl_dovecot_server.[hc].

	Safety: set the default LANG=C, instead of deleting LANG
	from the environment and assuming the right thing will
	happen. File: global/mail_params.h.

	Safety: always add the ISASCII() requirement to the ISXXX()
	macros, because they are used for protocol and policy
	enforcement.  File: util/sys_defs.h.

	Bugfix: null pointer in the 20051219 policy delegation
	crypto attributes.  File: smtpd/smtpd_check.c.

	Compatibility: "resolve_numeric_domain = yes" will accept
	addresses with numeric domains instead of rejecting them as
	invalid. Files: trivial-rewrite/resolve.c, util/vstring.c.

	Bugfix: 20051219 "postconf -A" produced "postconf -a" output.
	Andreas Winkelmann.


	Bugfix: the regexp map cleverly avoided scanning constant
	lookup results for non-existent $number expressions, but
	failed to subject those results to the necessary $$ -> $
	replacement. Files: util/dict_regexp.c.

	Performance: the pcre map did not optimize constant lookup
	results; they were always scanned for non-existent $number
	expressions.  File: util/dict_pcre.c.

	This round of edits eliminates architectural differences
	between the pcre and regexp table implementations.  The
	remaining difference is that regexp tables still support
	the obsolete "/pattern1/!/pattern2/ action" syntax, for
	backwards compatibility with Postfix 2.0 and earlier.


	Bugfix: the 20051222 ISASCII paranoia broke the strcasecmp()
	workaround for Solaris. File: util/strcasecmp.c.

	Bitrot: SunOS4 pre-dates size_t, ssize_t, getsid().  File:
	src/util/sys_defs.h. The SunOS4 tests had been suspended
	due to what turned out to be a broken AUI-to-UTP transceiver.

	Bugfix: the 20061226 cosmetic change broke non-IPV6 support
	(example: sockaddr_to_hostaddr: Unknown error: success).
	File: util/myaddrinfo.c.


	The following workaround was removed 20060103.

	Workaround: when mail is still queued after 3000 seconds,
	the SMTP client no longer pipelines the DOT+QUIT commands.
	The 20050929 paranoia about malformed server replies
	eliminated a rare occurrence of "lost mail" with sites that
	mis-implement DOT+QUIT pipelining, but resulted in a larger
	occurrence of repeated deliveries to sites with a different
	DOT+QUIT pipelining bug. The time threshold is set with the
	smtp_dot_quit_workaround_threshold_time parameter.  Files:
	smtp/smtp_proto.c, smtp/smtp.c.

	Feature: mailbox_transport_maps and fallback_transport_maps
	to search delivery transports by recipient name. Files:
	local/mailbox.c, local/unknown.c.

	Feature: the master daemon now logs a warning when all
	servers are busy that may accept remote connections, and
	suggests to either increase the process count or to reduce
	the service time per client.  Files: master/master_ent.c,


	Bugfix: the anvil server would terminate after "max_idle"
	seconds, even when this was less than the anvil_rate_time_unit
	interval. File: anvil/anvil.c.


	Deleted the 20051229 dot-quit bug workaround.  Automatically
	deferring delivery created "no delivery" and "repeated
	delivery" problems; and automatically turning off pipelining
	for delayed mail was a bad workaround for a bad workaround.
	The administrator still has the option to turn off pipelining
	by hand if loss of mail is a concern.


	Bugfix: the 20051217 fix (when a SASL client password is
	found, defer delivery when no server-announced mechanism
	survives the smtp_sasl_mechanism_filter) did the mechanism
	test too early, so that it could trip up with deliveries
	to servers that we don't have a SASL password for.  Files:
	smtp/smtp_sasl_proto.c, smtp/smtp_proto.c.


	Safety: new "smtp_cname_overrides_servername" parameter.
	The default value ("no") is NOT backwards compatible. This
	avoids surprises with the hostname that is used for logging,
	SASL password lookup, TLS policy decisions, or TLS certificate
	verification.  The change makes the 20051221 behavior more
	configurable.  Files: smtp/smtp_addr.c, smtp/smtp_connect.c,


	Cleanup: removed the unused DSN "code" attribute; removed
	surrogate SMTP replies for errors that were not reported
	by a remote SMTP server, making several DSN-related functions
	and macros redundant; cleaned up some bizarre code for DSN
	attribute memory management in the SMTP client.


	Cleanup: eliminated the global smtp_errno variable, which
	had become redundant after introducing DSN support. Files:
	smtp/smtp_addr.c, smtp/smtp_connect.c.


	Cleanup: removed more bizarre code for DSN attribute memory
	management in the queue manager, bounce server, and in
	delivery agents.


	Bugfix: smtp_sasl_tls_opts was unimplemented. File:

	Cleanup: more bounce logfile code cleanup.  Files:
	global/bounce_log.c, bounce/bounce_notify_util.c,
	bounce/bounce.c, bounce/bounce_notify_verp.c,
	bounce/bounce_one_service.c, showq/showq.c


	Cleanup: more bounce logfile code cleanup.  Files:
	global/bounce_log.c, bounce/bounce_notify_util.c.

	Bugfix: the VERP bouncer never handled the case of a missing
	bounce logfile. Found while doing more logfile code cleanup.
	File: bounce/bounce_notify_verp.c.

	Feature: smtp_sasl_tls_verified_security_options for
	connections where the server certificate passed verification.
	The default value is $smtp_sasl_tls_security_options, which
	in turn defaults to $smtp_sasl_security_options.


	Optimization: mystrdup() and mystrndup() now return a pointer
	to a fixed read-only memory location instead of allocating
	memory for zero-length null-terminated strings.  This saves
	lots of memory for unused recipient attributes. If this
	change causes problems (for example, you have an ancient
	sscanf() implementation that writes to its input) then
	compile Postfix with -DNO_SHARED_EMPTY_STRINGS.

	Cleanup: eliminated null pointer members in DSN structures.
	Instead we now use the optimized mystrdup() for empty
	strings. For safety sake we keep the tests for null pointers
	in input, but we always produce empty strings on output.
	Files: global/dsn.c, global/dsn.h, global/dsn_buf.h,

	Cleanup: eliminated ad-hoc code for passing recipients in
	the queue manager delivery request protocol. Postfix now
	uses proper object activation/passivation instead. Files:
	*qmgr/qmgr_deliver.c, global/deliver_request.c,


	Feature: to simplify debugging the bounce server logs the
	old and new queue ID when notifying the sender or postmaster.
	Files: global/post_mail.c, bounce/bounce_notify_service.c,
	bounce/bounce_one_service.c, bounce/bounce_notify_verp.c,
	bounce/bounce_warn_service.c, bounce/bounce_trace_service.c.

	Fudge: when translating recipient DSN codes into sender DSN
	codes, map sender address problems that have no DSN code
	to *.1.7 (Bad sender's mailbox address syntax) instead of
	*.1.0 (Other address status) because that loses the distinction
	between sender and recipient. File: smtpd/smtpd_dsn_fix.c.


	Cleanup: preserve upper case information of address localpart
	or extension when mapping one address to another with
	non-regexp/pcre tables.  Files: global/mail_addr_find.c,


	Bugfix: don't ignore the per-site policy when SSL library
	initialization fails. Introduced after adopting the TLS
	patch. File: smtp/smtp_session.c.


	[withdrawn 20060126] Safety: daemon processes that need no
	privileges now insist that they are configured to run without
	privileges.  Files: master/single_server.c, master/multi_server.c,

	Cleanup: preserve upper case information of address localpart
	or extension when mapping addresses via regexp/pcre tables.
	This requires that Postfix does not case fold the search
	string when searching regexp or pcre tables, so that $number
	substitutions produce the expected result.

	In order to get a consistent handling of table operations,
	the search string case folding logic was moved from the
	application to the individual lookup table modules; the
	application specifies its case folding preference when it
	opens a table, and the table folds the search or update
	string as needed.

	Files: everything that opens a map or multiple maps (to
	specify the case folding preference), and everything that
	contained ad-hoc code to lowercase search strings (which
	is no longer needed).

	Bugfix: as a side effect of this revision of all code that
	opens tables, the postmap/postalias -n/-N options are no
	longer silently ignored when the -q (query) and -d (delete)
	options are specified.  Files: postmap/postmap.c,

	Safety: don't allow $number substitution in transport maps
	or sender-dependent relayhost maps.

	Cleanup: smtp_sasl_passwd_maps lookup keys are folded to
	lowercase before searching tables such as btree:, dbm: or
	hash: that have fixed-case fields. File: smtp/smtp_sasl_glue.c.

	Bugfix: per-sender relayhost maps were not locked for shared


	Cleanup: don't look up parent domain substrings in regexp/pcre
	like tables while searching a hostname in a domain/namaddr_list.
	File: util/match_ops.c.


	Cleanup: multiple boolean variables were replaced by a
	single TLS enforcement level (none, may, encrypt, verify).
	With Victor Duchovni. Files: smtp_session.c, smtp_proto.c,

	Cleanup: the SMTP per-site policy table was re-implemented
	in terms of enforcement levels instead of multiple boolean
	variables. This greatly simplified the code and led to the
	elimination of non-intuitive behavior as documented next.
	With Victor Duchovni. Files: smtp_session.c, smtp.h.

	Bugfix: a TLS per-site MUST_NOPEERMATCH policy could not
	override a main.cf MUST (with peer match) policy, while a
	per-site NONE policy could.

	Bugfix: a combined TLS per-site (host, next-hop) policy of
	(NONE, MAY) would change the strongest main.cf MUST policy
	into NONE, while it changed all weaker main.cf policies
	into MAY.  The result is now NONE for all main.cf policy


	Feature: recipient_count attribute in SMTPD policy protocol.
	This is available only in the DATA and END-OF-MESSAGE stage.
	Based on code by Guo Black. Files: smtpd_check.c.

	Cleanup: renamed MUMBLE_NUM to MUMBLE_INT to make type
	discrepancies more explicit.

	Bugfix: change 20051208 broke when a connection could not
	be established. File: util/auto_clnt.c.


	Bugfix: the virtual(8) delivery agent did not insist on
	privileged operation as it should; this broke change 20060117.
	Ralf Hildebrandt.  File: virtual/virtual.c.

	Bugfix: the TLS sasl security options (change 20060110)
	should also be #ifdef USE_TLS, and not only #ifdef
	USE_SASL_AUTH.  Such feature interference is difficult to
	find in testing.  Liviu Daia. File: smtp/smtp_sasl_proto.c.


	Undo: change 20060117 (unprivileged operation test) broke
	"sendmail -bs", "postconf -b", "postconf -t", and probably
	more. Files: master/{single,multi,trigger}_server.c.


	Bugfix: an empty remote_header_rewrite_domain value caused
	trivial-rewrite to dereference a null pointer, but only in
	regression tests, not in production. Envelope addresses are
	by definition rewritten in the local domain context, because
	an address without domain is equivalent to an address in
	the local domain; and header addresses are rewritten in the
	remote context only when remote_header_rewrite_domain is
	non-empty.  File: trivial-rewrite/rewrite.c.


	Cleanup: regression tests are now separated into "make
	tests" for unprivileged tests, and "make root_tests" for
	tests that require privileges to connect to the Postfix
	internal sockets. Files Makefile.in, src/*/Makefile.in.


	Bugfix: despite efforts to treat malformed domain names as
	hard errors (change 20050726) they were still processed as
	soft errors. File: dns/dns_lookup.c.


	Bugfix: smtpd core dump when SASL was compiled in, turned
	off (smtpd_sasl_auth_enable = no) and permit_sasl_authenticated
	was specified in local_header_rewrite_clients. Victor
	Duchovni.  File: smtpd/smtpd_check.c.

	Cleanup: don't complain about useless SASL or TLS "permit"
	restrictions when SASL or TLS aren't compiled in, but do
	reject mail when reject_plaintext_session is specified while
	TLS isn't compiled in. File: smtpd/smtpd_check.c.


	Bugfix: disable the content_filter feature for user-requested
	"sendmail -bv" probes, just like it is disabled for probes
	generated by Postfix itself.  File: *qmgr/qmgr_message.c.


	Robustness: place the "do we have TLS" guards within method
	implementations, instead of putting them around method
	invocations.  File: smtpd/smtpd_check.c.

	Bugfix: duplicate the cleanup(8) DSN envelope ID syntax
	check in smtpd(8), so that clients get better error replies.
	File: smtpd/smtpd_check.c.

	Bugfix: change 20060203 broke the reject_plaintext_session

	The trivial-rewrite and proxymap multi-server processes now
	terminate soon after all their clients disconnect, instead
	of waiting for another 100 seconds. This allows the processes
	to refresh more frequently on low-traffic systems.

	Cleanup: smtpd_delay_open_until_valid_rcpt (default: yes)
	controls whether Postfix delays the start of a mail transaction
	until after the first valid recipient, or if it starts a
	transaction immediately after MAIL FROM. File: smtpd/smtpd.c.


	Bugfix: don't terminate with a non-standard exit status
	when the pipe-to-command feature has a problem before it
	executes the command. File: global/pipe_command.c.


	Bugfix: detect integer overflow when multiplying time values
	with non-trivial time units. File: global/conv_time.c.


	Bugfix: reset the msg_cleanup() fatal error handler in child
	processes. See also change 20060217. Files: postlock/postlock.c,
	master/multi_server.c, global/mail_run.c, util/vstream_popen.c.


	Bugfix: the MIME processor assumed that input was null
	terminated. This broke with CRLF input to the "sendmail -t"
	command  in Postfix 2.1 and later (see change 20030416).
	Found by Leandro Santi.  Based on patch by Victor Duchovni.
	Files: global/mime_state.c, global/is_header.c.


	Cleanup: the message arrival time (start of the receive
	transaction) no longer controls message expiration or
	delivery attempts.  Instead, expiration and delivery are
	now controlled by the time when the cleanup server creates
	a queue file.  This closes a problem that was introduced
	with the 20051104 change that introduced higher-resolution
	delay time keeping: as a result, "postsuper -r" could no
	longer manipulate the mail expiration schedule, so that
	mail "on hold" could expire too soon.


	Workaround. the PCRE library reports an inappropriate error
	code (invalid substring) when $number refers to a valid ()
	expression that matches the null string. This caused fatal
	run-time errors.  File: dict_pcre.c.


	Cleanup: eliminated name collisions between global and local
	variables, and other forms of shadowing. Documented switch
	fall-throughs with /* FALLTHROUGH */ where this wasn't
	already done.  Replaced (var = expr) by (var = expr) != 0
	where this wasn't already done.


	Bugfix: mis-placed parenthesis in a before-filter error
	test. A filter timeout was mis-reported as lost connection.
	Found in code review.  File: smtpd/smtpd_proxy.c.


	Cleanup: the SQL and LDAP clients now log a warning when
	they skip an empty lookup result, so that humans don't have
	to wonder why Postfix doesn't find all the database entries.
	File: global/db_common.c.

	Moved SMTP/LMTP parameter initialization from global/mail_params.c
	to the combined smtp/lmtp delivery agent. Added missing
	lmtp parameters.


	Feature: configurable chroot directive for the pipe(8)
	delivery agent, by Przemyslaw Wegrzyn. Files:
	global/pipe_command.c, pipe/pipe.c.

	Bugfix: cut-and-paste error: lmtp_connection_cache_limit
	was left with the name of smtp_connection_cache_limit.
	Reported by Victor? File: src/global/mail_params.h.


	More extensible interface for TLS client/server library,
	now passes property structures that combine all the relevant
	parameters in one type-safe structure.

	TLS session cache activity logging now takes place at TLS
	log level 2 or greater.


	Cleanup: made fcntl/flock handling consistent with respect
	to EINTR (reported by Carlo Contavalli). However, Postfix
	is not meant to be signal safe.  Only the master daemon
	handles signals without terminating, and it uses only a
	small subset of Postfix library routines. File: util/myflock.c.

	Bugfix: the pipe-to-command error message was lost when the
	command could not be executed. File: global/pipe_command.c.


	Bugfix in sanity check: after reading a record from the
	address verification database, a sanity check did not reject
	a record with all-zero time stamp fields.  Such records are
	never written; the test is there just in case something is
	broken, so that Postfix will not blindly march on and create
	chaos. The sanity check tested pointer values, instead of
	dereferencing the pointers.  Found by Coverity.  File:

	Bugfix in sanity check: when the maildir delivery routine
	opens an output file it looks up the file attributes via
	the file handle it just got.  There is a sanity check that
	detects if the attribute lookup fails, an error that never
	happens. The code that handles the impossible error did not
	close the output file. This would cause a virtual or local
	delivery agent to waste up to 100 file descriptors.  But
	for that error to happen the system would have to be so
	sick that you would have more serious problems than a file
	descriptor leak.  Found by Coverity.  Files: local/maildir.c,


	Bugfix: the MIME parser assumed input is null terminated
	when reporting errors. Fix by Leandro Santi. Files:
	global/mime_state.c, cleanup/cleanup_message.c.


	Bugfix: the SMTP server logged no warning when for some
	reason the TLS engine was unavailable in wrappermode. Victor
	Duchovni.  File: smtpd/smtpd.c.


	Cleanup: when SMTP access table lookup fails, reply with
	4xx instead of aborting with a fatal run-time error. The
	old behavior assumes local file access, and is inappropriate
	with deployment of LDAP and SQL tables. File: smtpd/smtpd_check.c.


	Bugfix: postcat did not print the attribute value of records
	containing a named attribute. File: postcat/postcat.c.


	Bugfix: dangling pointer in a function that has no caller.
	Found by Coverity. File: tls/tls_prng_exch.c.

	Bugfix: the workaround for CA-2003-07 (Sendmail) did not
	null terminate the address before logging a warning. Reported
	by Kris Kennaway. File: global/tok822_parse.c.


	Sendmail 8 Milter support, distributed across the smtpd(8)
	server for SMTP commands, and the cleanup(8) server for
	content inspection and manipulation. The code supports all
	requests to add/delete recipients, and to add/delete/replace
	message headers, but does not yet support requests to replace
	the message body.  See MILTER_README for more. Files:
	smtpd/smtpd.c, smtpd/smtpd_milter.c, cleanup/cleanup_api.c,
	cleanup/cleanup_envelope.c, cleanup/cleanup_extracted.c,
	cleanup/cleanup_milter.c, milter/milter.c, milter/milter8.c.

	That's 89 lines in smtpd, 1010 lines in cleanup, and 2449
	lines of library support, comments not included.  

	A simple test Milter application for use in regression tests
	is in src/milter/test-milter.c. Queue file modifications are
	tested with a driver at the end src/cleanup/cleanup_milter.c
	that reads commands from a script.

	To make debugging easier, uncomment the "#define msg_verbose
	2" lines at the top of cleanup_milter.c or milter8.c. This
	produces logging without making everything else verbose.


	Preliminary TLS_README and postconf(5) changes completed.
	Victor Duchovni.

	Added smtp_tls_policy_maps and smtp_tls_protocols features
	to the smtp/lmtp client, changed smtp_tls_cipherlist to
	only apply when TLS is mandatory. Victor Duchovni.


	Destinations that share a common server may have distinct
	TLS protocol and cipherlist requirements, with mandatory
	TLS add the protocol and cipherlist values to the TLS session
	lookup key. Victor Duchovni.


	Portability: __float80 alignment, by Albert Chin.  File:

	Further testing of Milter support uncovered typos; a missing
	null pointer test while cleaning up after content miltering;
	the need for a workaround to not bounce+delete local
	submission after it triggers a temporary reject Milter

	Workaround: don't bounce+delete a local submission after
	it triggers a "reject 4.x.x" action in header/body_checks.
	This means an SMTP client now sees "queue file write error"
	instead of the text from the "reject 4.x.x text" action.
	File: cleanup/cleanup_message.c.

	Workaround: OpenSSL 0.9.8[ab] with zlib support interoperability
	problem. Victor Duchovni. Files: tls/tls_client.c,
	tls/tls_misc.c, tls/tls_server.c.

	Added smtpd_tls_protocols parameter to complement
	smtp_tls_protocols. Victor Duchovni.


	The smtp_tls_policy_maps table now implements parent domain
	matching for destinations that are bare domains (without
	enclosing [] or optional :port suffix). This allows one to
	set TLS policy for a domain and all sub-domains. Victor


	The same parameter can bind to different variables in
	different daemons. Ignore the variable name when eliminating
	duplicates in extract.awk. Victor Duchovni.


	Improved handling of smtp_tls_protocols and smtpd_tls_protocols,
	names now processed via name_mask(3) and canonicalized prior
	to use in the SMTP/LMTP client TLS session lookup key. Also
	simplifies the corresponding code in the TLS driver. Victor


	Cleanup: send ETRN command parameter when using check_policy
	in the context of an ETRN command. Joshua Goodall. File:


	Bugfix (bug introduced 20051118): permit_mx_backup authorized
	domains without secondary MX records.  Joshua Goodall. File:


	Fixed default value of LMTP TLS client certificate parameters,
	using the SMTP values as a default was wrong. Victor Duchovni.


	Different transports may have different CAfile or CApath
	settings. We need to add the transport name to the TLS
	session lookup key so that sessions verified with one set
	of trusted roots are not inadvertantly considered verified
	for another. Victor Duchovni.


	Cleanup: minor fluff found with the BEAM source code analyzer.
	Files: global/quote_821_local.c, global/quote_822_local.c,
	master/master_spawn.c, pickup/pickup.c, util/match_ops.c,
	util/safe_open.c, xsasl/xsasl_cyrus_client.c.


	Safety: mail receiving daemons (smtpd, qmqpd) now pass
	actual client name/addres/helo attributes in addition to
	the attributes used for logging (xforward). This prevents
	Milter applications from treating qmqpd mail as if it
	originated locally, and prevents incorrect Milter decisions
	after "postsuper -r". Files: smtpd/smtpd.c, qmqpd/qmqpd.c,
	cleanup/cleanup_envelope.c, cleanup/cleanup_milter.c,
	cleanup/cleanup_state.c, global/post_mail.c, *qmgr/qmgr_message.c,
	*qmgr/qmgr_deliver.c, global/deliver_request.c,
	global/deliver_pass.c, local/forward.c.

	Bugfix: qmgr panic after queue file corruption by Mailscanner.
	Files: *qmgr/qmgr_message.c.

	Bugfix: XCLIENT didn't work with smtpd_delay_reject=no
	(problem reported by Joshua Goodall).  To make XCLIENT work
	correctly with built-in restrictions and with Milter
	applications, the SMTP server now jumps back to the very
	start (the 220 phase) of an SMTP session.  File: smtpd/smtpd.c.


	Portability: Some systems no longer support the traditional
	"sort +0 -2 +3". Victor Duchovni.


	Portability: Found by BEAM static code analyzer. SSL options
	(long) were stored as int.


	Cleanup: XCLIENT and XFORWARD attribute values are now sent
	as xtext encoded strings. For backwards compatibility,
	Postfix will still accept unencoded attribute values.  Files:
	smtpd/smtpd.c, smtpd/smtpd_proxy.c, smtp/smtp_proto.c.


	Robustness: additional sanity checks for common database
	routines. Viktor Dukhovni. File: global/db_common.c.

	Portability: LDAP 2.3 API support. Viktor Dukhovni. File:

	Security: the PostgreSQL client was updated after the
	PostgreSQL developers made major database API changes in
	response to PostgreSQL security issues. This breaks support
	for PGSQL versions prior to 8.1.4, 8.0.8, 7.4.13, and 7.3.15.
	Support for these requires major code changes which are not
	possible in the time that is left for the Postfix 2.3 stable

	Specific PostgreSQL client changes: use connection-aware
	quoting, and more robust PQexec() result handling.  Previous
	versions of the dict_pgsql driver didn't check the status
	of the result pointer, and certain exceptional events can
	be mis-interpreted as an empty result set.  Fixes by Leandro
	Santi. File: global/dict_pgsql.c.


	Changed smtp security level parsing and level->name conversion
	to use name_code(3). Victor Duchovni.

	Implemented new smtp_tls_security_level parameter, to replace
	the unnecessarily complex smtp_use_tls, smtp_enforce_tls
	and smtp_tls_enforce_peername parameters. The main.cf
	security level settings are now consistent with the new
	policy table. Victor Duchovni.

	The smtp_sasl_tls_verified_security_options feature is not
	yet complete, added #ifdef SNAPSHOT and changed documentation
	to delay introduction until Postfix 2.4. Victor Duchovni.


	Merged in Victor's work including the new TLS policy table
	and a complete set of configuration parameters for the LMTP
	personality of the unified SMTP/LMTP client.

	Allow mandatory TLS encryption with LMTP over UNIX-domain
	sockets. Victor Duchovni.

	Safety: improved code to avoid I/O on connections after the
	TLS handshake fails. Victor Duchovni.


	Cosmetic patch for const strings. Stefan Huehner.

	Other cosmetic changes, mainly whitespace.


	The qshape.pl script was updated for the pointer records
	that were introduced to support message content modification
	by Milter applications. Victor Duchovni.


	Feature: Substantially better cipherlist specification
	interface and support for anonymous ciphers when certificates
	are not needed. The primary interface in main.cf and the
	policy table selects one of 5 grades for mandatory TLS with
	smtp(8) or lmtp(8) or for all TLS sessions with smtpd(8).
	The levels are "high", "medium" (or better), "low" (or
	better), "export" (or better) and "null".  The underlying
	definitions of these levels are configurable, but users are
	strongly encouraged to not change those definitions. Victor


	Bugfix: the Milter reply syntax checker was off by one.
	File: milter/milter8.c.

	Workaround: disable SMTP connection cache lookup by server
	IP address when the tls_per_site policy table is enabled.
	This is a workaround for a shortcoming in the SMTP connection
	cache implementation, which retrieves the server hostname
	from the cached connection. Since this server name is not
	obtained in a secure manner, it must not be allowed to
	control the tls_per_site policy. File: smtp/smtp_reuse.c.


	Cleanup: mumble_mandatory_tls_mumble parameters renamed to
	mumble_tls_mandatory_mumble; added _mandatory_ qualifier
	to names of parameters that affect only mandatory TLS.


	Features promoted from SNAPSHOT to STABLE: the "sleep"
	pseudo restriction; Postfix daemons now read the local
	timezone file before chrooting; trivial-rewrite now detects
	table changes every 10 seconds, so it restarts more timely.

	Features that stay #ifdef SNAPSHOT: tcp_table,
	lmtp_sasl_tls_verified_security_options, and

	Compatibility: Sendmail does not send its own Received:
	header to Milter applications. Offsets in header replace
	requests are relative to the message content as received
	(i.e. without our own Received: header), while offsets in
	header insert requests are relative to the message as
	delivered (i.e. they include our own Received: header).
	This explains why dk-filter would sign our own Received:
	header but place the signature between our own Received:
	header and the rest of the message, violating the draft
	domainkeys spec.


	Cleanup: more graceful handling of queue file read/write
	errors while processing milter message modification requests.
	Files: cleanup/cleanup_milter.c, milter/milter8.c.


	Debugging: the Postfix milter client gives more context
	when it experiences trouble while talking to an uncooperative
	Milter application. File: milter/milter8.c.

	Compatibility: with OpenBSD 2.7 and later, the alias file
	is now in /etc/mail/aliases.


	Bugfix: the Milter client skipped zero-length body lines.
	File: milter/milter8.c.

	Feature (just this one): RFC 3834 "Auto-Submitted:" message
	header in DSNs.  File: bounce/bounce_notify_util.c.


	Portability: LP64 systems required a few ssize_t->int casts
	in debug logging statements.  Files: milter/test_milter.c,

	Cleanup: comments, error messages, and crumbling interfaces.


	Workaround: apparently, Solaris gettimeofday() can return
	out-of range microsecond values.  File: src/global/log_adhoc.c.

	Robustness: the SMTPD policy client now encodes the
	ccert_subject and ccert-issuer attributes as xtext.  Some
	characters are replaced by +XX, where XX is the two-digit
	hexadecimal code for the character value.  File:

	Safety: the SMTP/LMTP client now defers delivery when a
	SASL password exists, but the server does not offer SASL
	authentication. Mail could be rejected otherwise. This may
	become an issue now that Postfix retries delivery in plaintext
	after an opportunistic TLS handshake fails. Specify
	"smtp_sasl_auth_enforce = no" to deliver mail anyway.  File:
	smtp/smtp_proto.c. See workaround 20060711 for sender-dependent
	SASL passwords. This was undone with the 20060719 workaround.


	Cleanup: the new single smtpd_tls_security_level parameter
	obsoletes the multiple smtpd_use_tls and smtpd_enforce_tls
	parameters. This is done for consistency with the Postfix
	SMTP client. In the Postfix SMTP server, the levels "verify"
	and "secure" are currently not applicable, and are treated
	as "encrypt", after logging a warning. Files: smtpd/smtpd.c,
	tls/tls_level.c, smtp/smtp_session.c.

	Compatibility: don't send the first (blank) body line to
	Milter applications.  This broke domain key etc. signatures
	when verified by non-Postfix MTAs.  File: milter/milter8.c.


	Cleanup: more consistency between smtpd(8) and smtp(8) TLS
	configuration interfaces: smtpd_tls_mandatory_exclude_ciphers,
	smtpd_tls_mandatory_ciphers, smtpd_tls_mandatory_protocols.
	By Victor. Files:smtpd/smtpd.c.

	Cleanup: to support domainkey signing of bounces and
	Postmaster notices, enable content inspection of Postfix-
	generated mail with the new internal_mail_filter_classes
	feature.  This is disabled by default, because it is not
	yet safe enough. Files: global/int_filt.[hc] and everything
	that calls post_mail_fopen*().


	Cleanup: smtpd_tls_mumble -> smtpd_tls_mandatory_mumble,
	and finer control over the Postfix SMTP server TLS ciphers,
	all this for consistency with the same functionality in the
	Postfix SMTP client. Victor Duchovni.

	Compatibility: Sendmail's milter client handles whitespace
	after the header label and ":" in an interesting manner.
	It eats one space (not tab). File: milter/milter8.c.

	Workaround: if sender-dependent SASL passwords are enabled,
	don't defer delivery when a SASL password exists but the
	server doesn't announce SASL support. File: smtp/smtp_proto.c.
	This was undone with the 20060719 workaround.

	Cleanup: format of cleanup milter reject messages.  File:

	Bugfix: file/memory leak if a transfer of multiple milters
	from smtpd to cleanup broke in the middle.  Found by Coverity.
	File: milter/milter.c.


	Bugfix: "sendmail -bs" panic caused by a missing
	SMTPD_STATE_ALONE() guard before a milter_abort() call.
	File: smtpd/smtpd.c.

	Bugfix (bug introduced with Postfix 2.2): the Postfix SMTP
	client enforced Mandatory TLS only when talking to an ESMTP
	server; enforcement did not happen if Postfix could somehow
	be forced to send HELO instead of EHLO.  Victor Duchovni.
	File: src/smtp/smtp_proto.c.


	Bugfix (bug introduced 20060711): null pointer bug when
	rejecting SMTP mail with Milter application.  File:

	Workaround (problem introduced in 200605/200606 TLS update):
	the Postfix SMTP server now issues TLS session IDs even
	when TLS session caching is turned off, otherwise MS Outlook
	fails to deliver mail. There may also be interoperability
	issues with other MTAs that we haven't discovered yet.
	Specify "smtpd_tls_always_issue_session_ids = no" to disable
	the workaround. Victor Duchovni. Files: smtpd/smtpd.c,


	Cleanup: the smtp_sasl_auth_enforce feature is gone. It was
	meant to work around a problem that was introduced with
	plaintext fallback after a failed TLS handshake.  Unfortunately,
	it created more problems than it solved. We now address the
	underlying problem more directly as described next. File:

	Safety: don't fall back to plaintext delivery after failed
	TLS handshake, when the Postfix SMTP client would have
	attempted to log in with SASL after successful TLS handshake.
	This avoids undesirable behavior regardless of whether the
	server does support SASL over plaintext (unexpected password
	disclosure) and whether the server doesn't support SASL
	over plaintext (insufficient mail relay permission).  Files:
	smtp/smtp_connect.c, smtp/smtp_session.c, smtp/smtp_proto.c.


	Compatibility: replace %% in milter replies by %, and strip
	single (i.e. invalid) % characters. File: milter/milter8.c.

	Compatibility: $_ macro support for Milter applications.
	Files: smtpd/smtpd.c, smtpd/smtpd_milter.c,
	cleanup/cleanup_state.c, cleanup/cleanup_milter.c.


	Safety: disable Milter processing after "postsuper -r".  If
	the mail has been filtered there is no need to do it again.
	Moreover, when mail has passed through an external content
	filter, we don't have sufficient information to reproduce
	the exact same SMTP events and Sendmail macros that Milters
	received when the mail originally arrived in Postfix.  This
	change does not affect Milter applications that run behind
	an after-queue content filter. File: pickup/pickup.c.

	Bugfix: Milters received a truncated ORCPT=xxx parameter
	due to destructive parsing of something that didn't have
	to be preserved before Milter support was added to Postfix.
	File: smtpd/smtpd.c.


	Bugfix: when updating the same header multiple times, the
	Postfix Milter client created a queue file that caused
	delivery agents to loop.  File: cleanup/cleanup_milter.c.


	Bugfix: damaged queue file record after a Milter request
	to modify a message header when 1) it was the last header
	in the unmodified message, and 2) the old header was less
	than 15 characters long.  File: cleanup/cleanup_milter.c.

	Bugfix: don't panic in smtp_rcpt_cleanup() after detecting
	a damaged queue file record. File: smtp/smtp_proto.c.


	Bugfix: the 20051013 change to enforce the message size
	limit in the SMTP server didn't work for size limits close
	enough to INT_MAX. File: smtpd/smtpd.c.

	Bugfix (introduced Postfix 2.3): after an SMTP client was
	rejected with "smtpd_delay_reject = no", the SMTP server
	would panic as it generated spurious Milter requests for
	unrecognized commands.  File: smtpd/smtpd.c.


	Cleanup: change redundant milter_abort() and milter_disc_event()
	calls into NO-OPs.  This avoids unnecessary panic() events
	for completely harmless conditions.  File: milter/milter8.c.


	Bugfix (introduced Postfix 2.3): #ifdef damage caused
	smtp_sasl_start() to be invoked twice. Reported by C-J
	Lofstedt. File: smtp/smtp_sasl_proto.c.


	Postfix no longer announces its name in delivery status
	notifications.  Users believe that Wietse provides a free
	helpdesk service that solves all their email problems.
	Credits to Jonathan Balester.  File: bounce/bounce_templates.c.


	Bugfix (introduced Postfix 2.2): when upgrading from Postfix
	< 2.2 with the third-party TLS patch, the post-install
	upgrade procedure didn't put a "?" in the existing tlsmgr
	entry, causing tlsmgr to repeatedly start and exit when TLS
	support was not compiled in.  File: conf/post-install.


	Bugfix (introduced < Postfix alpha): safety mechanism in
	mail_date() didn't work.  Found in code review.  File:


	Test programs for host address->name and name->address
	lookups to debug name service inconsistencies, typically
	when the Postfix SMTP server claims that a hostname is
	"unknown".  Files: auxiliary/name-addr-test/*.


	Added missing logging for "message to large" etc.  Files:
	smtpd/smtpd.c, cleanup/cleanup_milter.c.


	Bugfix (introduced Postfix 2.2): segfault when vstream_fclose()
	attempted to flush unwritten output, after vstream_fdclose()
	had already disconnected the stream from its file descriptor.
	File: util/vstream.c.

	Bugfix (introduced Postfix 2.2): vstream_fdclose() did not
	flush unwritten output before disconnecting a stream from
	its file descriptor(s).  File: util/vstream.c.

	Feature: smtp-sink can capture mail to file, either as one
	individual message per file, or as multiple messages per
	file.  After an initial implementation by Weidong Cui. File:

	Bugfix (introduced < Postfix alpha): smtp-sink did not
	correctly recognize DOT-CR-LF immediately after DATA. File:

	Cleanup: smtp-sink now requires that MAIL FROM, RCPT TO and
	DATA be send in the correct order. This simplified the
	implementation of the capture to file feature. File:


	Portability: inside functions, GCC 4 refuses forward
	declarations of static functions.  File: smtpstone/smtp-sink.c.


	Bugfix (introduced Postfix 2.3): with headers-only mail, a
	Milter "header insert" action corrupted the queue file. The
	cleanup server executed some end-of-body action before the
	end-of-header actions. File: cleanup/cleanup_message.c.

	Robustness: mail delivery agents now detect loops in queue
	files. Files with too many backward jumps are saved to the
	"corrupt" directory.  File: global/record.c.


	Bugfix (introduced with initial implementation): missing
	"dict_errno = 0" caused mis-leading error messages after
	non-error lookup failure.  Victor Duchovni.  File:

	Robustness: the default TLS cipher lists were changed from
	!foo:ALL into ALL:!foo. Victor Duchovni.  Files:
	global/mail_params.h and documentation.


	Bugfix (introduced Postfix 2.3): the LMTP client stripped
	"inet": from the next-hop destination, but still used the
	complete next-hop from the delivery request. File:


	Cleanup: record loop detection.  File: global/record.c.


	Workaround: AIX 5.[1-3] getaddrinfo() creates socket address
	structures with a non-zero port value. This breaks the
	smtp_bind_address etc. features, and breaks inet_interfaces
	settings with only one IP address.  Problem reported by
	Hamish Marson.  Files: util/sock_addr.[hc], util/myaddrinfo.c.

	Bugfix (introduced with the Postfix TLS patch): memory leak
	in verify_extract_peer(). The OpenSSL documentation provides
	no information on how subjectAltNames are managed.  Sam
	Rushing, ironport.  File: tls/tls_client.c.

	Bugfix (introduced with Postfix 2.2): smtp_generic_maps 
	turned on MIME conversion. File: smtp/smtp_proto.c.

	Workaround: don't send SIZE information in the MAIL FROM
	command when message content will be subject to 8bit ->
	quoted-printable conversion.  File: smtp/smtp_proto.c.


	Compatibility: Sendmail now invokes the Milter connect
	action with the verified hostname instead of the name
	obtained with PTR lookup. File: smtpd/smtpd.c.


	Cleanup: force space between mailq queueid+status and file
	size items. File: showq/showq.c.


	Cleanup: make CISCO PIX bug workarounds configurable.  This
	introduces new parameters: smtp_pix_workarounds (default:
	disable_esmtp, delay_dotcrlf) and smtp_pix_workaround_maps
	(workarounds indexed by server IP address).  The default
	settings are backwards compatible. File: smtp/smtp.c,


	Workaround: include the smtpd(8) service name when searching
	the TLS session cache, to avoid cross-talk between multiple
	master.cf entries. This does not eliminate cross-talk between
	multiple (x)inetd.conf entries. Victor Duchovni. Files:
	smtpd/smtpd.c, tls/tls_server.c.


	Cleanup: convert the Milter {mail_addr} and {rcpt_addr}
	macro values to external form. File: smtpd/smtpd_milter.c.

	Cleanup: the Milter {mail_addr} and {rcpt_addr} macros are
	now available with non-SMTP mail. File: cleanup/cleanup_milter.c.

	Cleanup: convert addresses in Milter recipient add/delete
	requests to internal form.  File: cleanup/cleanup_milter.c.

	Cleanup: with non-SMTP mail, convert addresses in simulated
	MAIL FROM and RCPT TO events to external form.  File:


	Cleanup: removed spurious warning when the cleanup server
	attempts to bounce mail with soft_bounce=yes. Problem
	reported by Ralf Hildebrandt. File: cleanup/cleanup_bounce.c.

	Bugfix: null pointer bug when receiving a non-protocol
	response on a cached SMTP/LMTP connection.  Report by Brian
	Kantor.  Fix by Victor Duchovni.  File: smtp/smtp_reuse.c.


	Feature: new retry delivery agent, to avoid the synchronous
	defer service client in the queue manager. This code is
	co-located with the error(8) server. File: error/error.c.

	Performance: the queue manager could spend too much time
	in the synchronous defer service client, causing the watchdog
	timer to go off.  Where possible, the queue manager now
	bounces or defers recipients asynchronously, by routing
	them to the error or the retry delivery agent. Code by
	Wietse and Patrik Rak. Files: global/recipient_list.c,
	*qmgr/qmgr_error.c, *qmgr/qmgr_defer.c, *qmgr/qmgr_entry.c,
	*qmgr/qmgr_deliver.c, *qmgr/qmgr_message.c.

	Performance: refined recipient and job grouping, and more
	agressive early refill of in-memory recipients to prevent
	a worst-case scenario where the queue manager became starved
	until after the last batch of slow in-memory recipients of
	jumbo multi-recipient mail. Code by Patrik Rak.  Files:
	global/mail_conf_time.c, qmgr/qmgr_message.c, qmgr/qmgr.c,
	qmgr/qmgr.h, qmgr/qmgr_entry.c, qmgr/qmgr_job.c,
	qmgr/qmgr_message.c, qmgr/qmgr_transport.c.


	Bugfix: the Postfix install/upgrade procedure broke with
	non-default config_directory. File: conf/post-install.


	Bugfix: null pointer bug in end-of-header Milter action
	when the last header line is too large.  Reported by Mark
	Martinec. The root of the problem is that the MIME state
	engine may execute up to three call-back functions when it
	reaches the end of the headers, before it returns to the
	caller; as long as call-backs return no result, each call-back
	has to check for itself if a previous call-back ran into a
	problem.  File: milter/milter8.c.

	Workaround: reduce effective header_size_limit to 60000
	when Milter inspection is enabled, to avoid breaking the
	Milter protocol request length limit. File:


	Safety: don't read more than 5000 recipients at a time, to
	avoid spending too much time away from interrupts.  File:


	Workaround: don't complain with "Error 0" in the trivial-rewrite,
	verify, proxymap or connection cache client when the server
	exits after the client sends its request. We still complain,
	however, when the problem persists.  Files: global/rewrite_clnt.c,
	global/resolve_clnt.c, global/verify_clnt.c, global/scache_clnt.c,

	Safety: the header_size_limit is now enforced more strictly,
	to avoid inter-operability problems with the Milter protocol.
	Long headers are truncated at a line boundary if possible,
	otherwise they are cut between line boundaries. File:


	Bugfix (introduced with Postfix 2.2): with SMTP server
	tarpit delays of smtp_rset_timeout or larger, the SMTP
	client could get out of sync with the server while reusing
	a connection.  The symptoms were "recipient rejected .. in
	reply to DATA".  Fix by Victor Duchovni and Wietse.  Files:
	smtp/smtp_proto.c, smtp/smtp_connect.c.

	Robustness: the vbuf and vstream documentation claimed that
	their *error() macros reported timeout errors, but they
	didn't really. The implementation was fixed, and redundant
	vstream_ftimeout() calls were removed. As a result, many
	Postfix daemons now properly detect write timeout errors
	on internal connections.  Files: util/vbuf.h.

	Workaround: some broken SMTP servers reply and hang up in
	the middle of DATA. The Postfix SMTP client now stops sending
	and tries to receive the server response. This can help to
	avoid repeated delivery attempts. Initial implementation
	by Wietse, later work by Victor Duchovni. Files:
	smtp/smtp_proto.c, smtpstone/smtp-sink.c, util/vstream.c,
	plus trivial mods for code thatr calls vstream_fpurge().


	Compatibility: The Postfix installation/upgrade procedure
	no longer sets "unknown_local_recipient_code = 450" in
	main.cf. This was a safety net for upgrades from Postfix
	1.x. Four years later is no longer needed. File:

	Cleanup: removed vstream_fclose() error warning in the code
	that disconnects from a delivery agent. There is no need
	to report errors here because they would already be reported
	earlier.  Files: *qmgr/qmgr_deliver.c.

	Robustness: "kill me after N seconds" feature to ensure
	that a daemon process does not get stuck while preparing
	for exit after signal arrival. File: util/killme_after.[hc],
	util/watchdog.c, master/master_sig.c.


	Robustness: low-cost re-entrancy guard that allows daemons
	to safely call msg_fatal() etc. from a signal handler,
	without risking memory corruption, or deadlock on Redhat
	Linux.  This works provided that the signal handler terminates
	the process. In that special case we need not guarantee
	after-the-fact consistency of the thread that was interrupted.
	File: util/msg_output.c.

	Robustness: replace exit() calls by _exit(). File: util/msg.c,


	Workaround: on systems with usable futimes() or equivalent
	(Solaris, *BSD, MacOS, but not Linux), always explicitly
	set the queue file last modification time stamps while
	creating a queue file. With this, Postfix can avoid logging
	warnings when the file system clock is ahead of the local
	clock.  Clock skew can be a problem, because Postfix does
	not deliver mail until the local clock catches up with the
	queue file's last modification time stamp.  File:

	Workaround: on systems without usable futimes() or equivalent,
	log a warning when the file system clock is more than 100
	seconds behind the local clock. This does not cause mail
	delivery problems, but it just looks silly in message
	headers. File: global/mail_stream.c.

	On systems without usable futimes() (Linux, and ancient
	versions of Solaris, SunOS and *BSD) Postfix will keep using
	the slower utime() system call to update queue file time
	stamps when the file system clock is off with respect to
	the local system clock.

	Compatibility with Postfix < 2.3: undo the change to bounce
	instead of defer after pipe-to-command delivery fails with
	a signal. File: global/pipe_command.c.


	Workaround: apparently, some mail software removes or hides
	"<postmaster>" in the Postfix bounce text, because it
	processes the text as if it were HTML. This confuses users.
	The bounce template has been updated to remove the < and
	>.  File: bounce/bounce_templates.c.

	Cleanup: when smtp_generic_maps is turned on, don't parse
	MIME structures in the message body. Victor Duchovni. File:


	Cleanup: streamline the signal handler reentrancy protections,
	and document under what conditions these protections work,
	with REENTRANCY sections in the relevant man pages. Files:
	util/vbuf_print.c.  util/msg.c, util/msg_output.c.


	Cleanup: when doing server access control by the remote TLS
	client fingerprint, do not require client certificate
	verification.  Victor Duchovni.  File: smtpd/smtpd_check.c.

	Safety: when the remote TLS client certificate isn't verified,
	don't send ccert_subject and ccert_issuer attributes in
	check_policy_service requests. Victor Duchovni. File:

	Bugfix: the postconf command still complained about an
	unqualified machine name, because it was not updated with
	the 20050513 change that introduced a default "mydomain =
	localdomain".  File: postconf/postconf.c.


	Bugfix: race condition in "ETRN site", "sendmail -qRsite"
	and "postqueue -s site". When the command arrived while an
	incoming queue scan was already in progress, mail could
	stay deferred instead of being flushed. The fix was to
	unthrottle the queue manager before moving files from the
	deferred queue to the incoming queue.  Files: flush/flush.c,

	Cleanup: the sendmail and postqueue commands no longer
	terminate with a non-standard error status after a run-time
	error in some Postfix internal routine (typically, some
	essential file is not accessible, or the system is out of
	memory). Files: sendmail/sendmail.c, postqueue/postqueue.c.

	Feature: "sendmail -qIqueueid" and "postqueue -i queueid"
	to flush a specific queue file. Files: sendmail/sendmail.c,
	postqueue/postqueue.c, global/flush_clnt.c, flush/flush.c.


	Performance: "sendmail -qIqueueid" and "postqueue -i queueid"
	unthrottle only the necessary message delivery transports
	and queues. The unthrottle request now is propagated to the
	queue manager via queue file group read permission bits.
	Based on initial implementation by Victor Duchovni.  Files:
	flush/flush.c, *qmgr/qmgr.c, *qmgr/qmgr_scan.c,
	*qmgr/qmgr_active.c, *qmgr/qmgr_message.c.


	Workaround: PMilter 0.95 does not deliver SMFIC_EOB+data
	to the application as SMFIC_BODY+data followed by SMFIC_EOB.
	To avoid compatibility problems, Postfix now sends
	SMFIC_BODY+data followed by SMFIC_EOB.  File: milter/milter8.c.

	Bugfix (introduced with Postfix 2.3): when inserting
	Milter-generated headers at increasing positions in a
	message, a later header could end up at a previously used
	insertion point.  Thus, inserting headers at positions (N,
	N+M) could work as if (N, N) had been specified. Problem
	reported by Mark Martinec.  File: milter/milter8.c.


	Feature: time unit suffix support in _command_time_limit.
	Files: pipe/pipe.c, spawn/spawn.c.


	Bugfix (introduced with Postfix 2.3): the MX hostname syntax
	check was skipped with reject_unknown_helo_hostname and
	reject_unknown_sender/recipient_domain, so that Postfix
	would still accept mail from domains with a zero-length MX
	hostname.  File: smtpd/smtpd_check.c.


	Cleanup: use separate TLS_LEGACY_README to document the old
	TLS user interface. This will simplify TLS_README dramatically.

	Cleanup: untangled spaghetti code. File: util/inet_listen.c.


	Bugfix (introduced Postfix 2.3): when creating an alias map
	on a NIS-enabled system, don't case-fold the YP_MASTER_NAME
	and YP_LAST_MODIFIED lookup keys. This requires that an
	application can turn on/off case folding on the fly.  Files:
	postalias/postalias.c, global/dict_mumble.c, util/dict_mumble.c,

	Cleanup: after the above revision of the proxymap protocol,
	the proxymap server can now share the same map with clients
	that have only minor differences in dictionary open/access


	Performance: pipeline of pending delivery agent connections,
	to improve Linux/Solaris mail delivery performance by another
	10% while going down-hill with the wind from behind. Design
	and implementation Victor and Wietse. Files: *qmgr/qmgr.c,
	*qmgr/qmgr.h, *qmgr/qmgr_transport.c.


	Cleanup: eliminate the Linux/Solaris "wait for accept()"
	stage from the queue manager to delivery agent protocol.
	This alone achieves 99.99% of the Linux/Solaris speed up
	from the preceding change. The pending connection pipeline
	takes care of the rest.  Tested on Linux kernels dating
	back to 2.0.27 (that's more than 10 years ago).  Files:


	Bugfix (introduced 20011008): after return from nested
	access restriction, possible longjump into exited stack
	frame upon configuration error or table lookup error. Victor
	Duchovni.  Files: smtpd/smtpd_check.c.

	Workaround: don't insert header/body blank line separator
	in malformed attachments, to avoid breaking digital signatures.
	Switch from header to body state, for robust MIME parsing.
	People concerned about MIME evasion can use a MIME normalizer
	to corrupt their user's legitimate email.  File:


	Feature: body replacement support for Milter applications.
	Postfix 2.3 and older 2.4 versions will be able to deliver
	body-replaced queue files, but will report the message size
	as it was before the body was replaced.  Files: milter/milter8.c,
	cleanup/cleanup_milter.c, cleanup/cleanup_body_region.c.


	Cleanup: reusable infrastructure for body replacement.
	Files: cleanup/cleanup_body_edit.c, cleanup/cleanup_region.c.


	Bugfix: match lists didn't implement ![ipv6address].  Problem
	reported by Paulo Pacheco. File: util/match_list.c.

	Cleanup: revised the matchlist "!" support, added support
	for !/file/name, and updated the documentation. File:


	Cleanup: pad short message headers with a filler record,
	so that the result is never shorter than a pointer record.
	This immensely simplified the support for Milter header
	modification requests: three complex loops could be replaced
	by one simpler loop.  The DTXT record type was re-purposed
	from "deleted header text" to "short header padding", keeping
	the change backwards compatible.  Files: cleanup/cleanup_out.c,
	cleanup/cleanup_milter.c, global/record.c.

	Cleanup: the Milter "add recipient" action always added the
	recipient to the initial envelope segment, causing added
	recipients to be separate from "sendmail -t" recipients.
	This violated design, without impact on delivery (always_bcc
	recipient are always at the end of the queue file even when
	all other recipients are in the initial segment).  File:


	Workaround: OpenSSL falsely concludes that AES256 support
	is present when only AES128 is available.  Code by Victor
	Duchovni.  File: tls/tls_misc.c.


	Disable workaround pending completion of updated TLS]
	support in non-production releases.


	Assorted code cleanup, portability fixes/workarounds, and
	minor updates: global/dict_ldap.c, mantools/postlink,
	tlsmgs/tlsmgr.c, conf/master.cf. LaMont Jones.


	Portability: GNU Hurd support for multiple kernel environments.
	LaMont Jones. Files: util/sys_defs.h, makedefs.

	Cleanup: some default settings were adjusted to better fit
	today's environment: queue_run_delay and minimal_backoff_time
	were reduced from 1000s to 300s, so that deliveries are
	retried earlier after the first failure; ipc_idle was reduced
	from 100s to 5s, so that tlsmgr and scache clients will
	more quickly release unused file handles. Files:
	global/mail_params.h, proto/postconf.5.html


	Catch-up: FreeBSD kqueue support. File: util/events.c.


	System-V poll(2) support. This is now the preferred method
	to test a single file descriptor on sufficiently recent
	versions of FreeBSD, NetBSD, OpenBSD, Solaris and Linux;
	other systems will be added as evidence becomes available
	of usable poll(2) implementations. Files: util/read_wait.c,
	util/write_wait.c, util/readble.c, util/writable.c.

	Streamlined the event_enable_read/write implementation to
	speed up smtp-source performance, by eliminating expensive
	kqueue/devpoll/epoll system calls when only the application
	call-back information changes. On FreeBSD, smtp-sink/source
	tests now run 5% faster than with the old select(2) based
	implementation.  File util/events.c.


	Catch-up: Solaris /dev/poll support. File: util/events.c.

	Bugfix (introduced 20060823): initial state was not in state
	machine, causing memory access outside the lookup table.
	File: smtpstone/smtp-sink.c.


	Catch-up: Linux epoll support. File: util/events.c.


	Polished the kqueue/devpoll/epoll support; this is now
	enabled by default on sufficiently recent versions of
	FreeBSD, NetBSD, OpenBSD, Solaris and Linux; other systems
	will be added as evidence becomes available of usable
	implementations. File: util/events.c.


	Further polish: removed some typos from new code in the
	events.c handler, undid some unnecessary changes to the
	{read,write}{_wait,able}.c modules, and addressed Victor's
	paranoia for multi-client servers with a thousand clients
	while linked with library routines that can't handle file
	descriptors >= FD_SETSIZE.

	Cleanup: while debugging the new events.c handler, removed
	an unnecessary "write after connect" call-back event. File:


	Robustness: in the queue manager keep a number of free file
	descriptor slots at the low end, to work around library
	routines that can't handle file descriptors >= FD_SETSIZE.
	Files: *qmgr/qmgr_transport.c, util/vstream.[hc]


	Bugfix (introduced 20070114 with Milter body edit support):
	the cleanup server terminated with a fatal error when SMTP
	mail exceeded the message size limit, instead of handling
	it as a non-fatal error. Files: cleanup/cleanup_extracted.c,
	cleanup/cleanup_final.c, cleanup/cleanup_bounce.c,


	Streamline the compile time selection of event handling
	styles, replacing multiple on/off macros by just one
	multi-valued macro. Files: util/sys_defs.h, util/events.c,
	master/multi_server.c, *qmgr/qmgr_transport.c.


	Work-around: Disable SSL/TLS ciphers when the underlying
	symmetric algorithm is not available in the OpenSSL crypto
	library at the required bit strength. Problem observed with
	SunOS 5.10's bundled OpenSSL 0.9.7 and AES 256. Also possible
	with OpenSSL 0.9.8 and CAMELLIA 256. Root cause fixed in
	upcoming OpenSSL 0.9.7m, 0.9.8e and 0.9.9 releases. Victor
	Duchovni, Morgan Stanley. Files: src/smtp/smtp_proto.c,
	src/smtpd/smtpd.c, src/tls/tls.h, src/tls/tls_client.c,
	src/tls/tls_misc.c and src/tls/tls_server.c.


	Workaround: delayed "postfix reload" with ancient FreeBSD4
	kqueue implementations, causing the first external or
	internal clients after "postfix reload" to experience a
	quick disconnect.  Apparently, these kqueue implementations
	do not deliver a read notification when the master closes
	the per-service shared master/child status pipe (even when
	there is only one child; note that the master keeps a handle
	to both ends of each status pipe).  A child process remains
	ignorant that the status pipe was closed until the arrival
	of the next client request, and then terminates.  The
	workaround is to ignore master status write errors before
	handling a service request.  Files: master/*_server.c.

	Cleanup: fix race condition that caused unnecessary "premature
	end-of-input" warning messages when "postfix reload" was
	issued on a busy mail server. Files: util/attr_scan*c.


	Cleanup: syslog_name now works as documented with both
	daemons and commands (including set-gid commands).  Files:
	global/mail_task.c postlog/postlog.c, global/mail_version.h,
	sendmail/sendmail.c, postsuper/postsuper.c, postalias/postalias.c,
	postmap/postmap.c, postqueue/postqueue.c, postdrop/postdrop.c,
	master/trigger_server.c, master/single_server.c,


	Workaround: GNU POP3D creates a new mailbox and deletes the
	old one. Postfix now backs off and retries delivery later,
	instead of appending mail to a deleted file.  To minimize
	the use of this workaround, Postfix now by default creates
	mailbox dotlock files on all systems, and creates dotlock
	files before opening mailbox files.  Files: util/sys_defs.h,


	Workaround: updated workaround for broken Solaris accept().
	File: util/inet_listen.c.

	Workaround: on some FreeBSD versions, accept(2) can fail
	with a bogus EINVAL error. We now allow accept(2) to fail
	for a limited number of times before terminating the process.
	Files: master/single_server.c, master/multi_server.c.


	Bugfix (introduced with Postfix 2.3 Milter support): postdrop
	reported "illegal seek" instead of "file too large".  File:


	Cleanup: specify "undisclosed_recipients_header =" to disable
	Postfix's "To: undisclosed-recipients:;" header for mail
	that lists no recipient. The To: header is not required as
	of RFC 2822.  The undisclosed_recipients_header parameter
	value can now be an empty string, a value that was not
	allowed with earlier Postfix versions. With Postfix 2.5 it
	will be empty by default. Files: cleanup/cleanup.c,


	Backwards compatibility: don't pad short message header
	records when Milter support is turned off. This maintains
	compatibility with Postfix versions that pre-date Milter
	support. File: cleanup/cleanup_out.c.


	Bitrot: move the "don't run this daemon by hand" message
	before other tests. Files: master/*server.c.


	Bitrot: New OpenLDAP APIs deprecate simplified interfaces,
	that are the only ones available in Sun's LDAP SDK. Define
	suitable macros that work with new OpenLDAP and Sun's code.
	Victor Duchovni, Morgan Stanley. File: src/global/dict_ldap.c

	Cleanup: new "leaf" and "terminal" result attributes support
	fine-tuning of LDAP group expansion, and provide a solution
	for the problem case where DN recursion returns both the
	group address and the addresses of the member objects.
	Victor Duchovni, Morgan Stanley.  Files: src/global/dict_ldap.c,
	proto/LDAP_README.html, proto/ldap_table


	Idioten Sicherheit: stamp every executable file and every
	core dump file with "mail_version=xxxxx". Adding version
	stamps and checks to every IPC message is too much change
	after code freeze, and requires too much time for testing.
	File: src/global/mail_version.h and every main program file.


	Bugfix (introduced between 20070120 and 20070121): the
	cleanup server stored no "delayed mail warning" queue file
	records with "sendmail -t", and no header_checks filter/redirect
	records or content encoding records with other mail.  File:


	Bugfix (introduced 20070224): local(8) or virtual(8) could
	log a misleading error message after failure to open a
	mailbox file. File: global/mbox_open.c.

	Bugfix (code should have been updated 20070104): the proxymap
	client did not propagate changes in case folding flags.
	Currently, nothing in Postfix uses this functionality.
	File: global/dict_proxy.c.


	Bugfix: postfix-install didn't work for symlink or hardlink
	targets, when the parent directory had a value of "no".


	Workaround: Eric Raymond's man page formatters don't handle
	low-level *roff .in or .ti controls. We now use .nf and .fi
	instead. Files: many.


	Bugfix (introduced Postfix 2.3): segfault with HOLD action
	in access/header_checks/body_checks on 64-bit platforms.
	File: cleanup/cleanup_api.c.


	Portability (introduced 20070325): the fix for hardlinks
	and symlinks in postfix-install forgot to work around shells
	where "IFS=/ command" makes the IFS setting permanent.  This
	is allowed by some broken standard, and affects Solaris.
	File: postfix-install.

	Portability (introduced 20070212): the workaround for
	non-existent library bugs with descriptors >= FD_SETSIZE
	broke with "fcntl F_DUPFD: Invalid argument" on 64-bit
	Solaris.  Files: master/multi_server.c, *qmgr/qmgr_transport.c.


	Feature: BCC access/policy action, to demonstrate that this
	is not a good feature. The action's behavior is non-intuitive
	and requires too much documentation to explain.  It's
	therefore snapshot only.  File: smtpd/smtpd_check.c.


	Cleanup: expire cached results from addres rewriting, address
	resolution, and from transport map lookups.  Results expire
	after 30 seconds; short enough that it doesn't freak out
	people who run the same test repeatedly, and long enough
	that it doesn't upset other people with continuous streams
	of "*" transport map lookups.  Files: global/rewrite_clnt.c,
	global/resolve_clnt.c, trivial-rewrite/transport.c.


	Cleanup: on (Linux) platforms that cripple signal handlers
	with deadlock, "postfix stop" now forcefully stops all the
	processes in the master's process group, not just the master
	process alone.  File: conf/postfix-script.


	Cleanup: the "Delivered-To:" loop detection implementation
	was moved from the local(8) delivery agent to the library,
	where it can also be used by other delivery agents. Files:

	Safety: the "Delivered-To:" loop detection implementation
	keeps state for no more than 1000 "Delivered-To:" headers.

	Feature: $domain command-line macro support, to get access
	to the recipient address domain portion.  Based on code by
	Koen Vermeer. File: pipe/pipe.c.

	Cleanup: support for "Delivered-To:" loop detection in the
	pipe(8) delivery agent. This follows a general principle:
	if a program creates the "Delivered-To:" header, then it
	is also responsible for "Delivered-To:" loop detection.
	File pipe/pipe.c.


	The cache expiring transport map lookups did not distinguish
	between wildcard transport map entry with an "empty" transport
	field, or no wildcard transport map entry.


	Cleanup: making hard-coded behavior configurable. In this
	case, extracting 8BITMIME encoding information from
	Content-Transfer-Encoding: message headers.  The default
	behavior, "detect_8bit_encoding_header = yes", is backwards
	compatible. This behavior was introduced to generate
	RFC-compliant bounce messages before Postfix supported the
	8BITMIME option in the MAIL FROM command and on the Postfix
	sendmail command line.  Files: cleanup/cleanup_init.c,
	cleanup/cleanup_message.c, global/mail_params.h.


	Bugfix: don't falsely report "lost connection from
	localhost[]" when Postfix is being portscanned.
	Files: smtpd/smtpd_peer.c, qmqpd/qmqpd_peer.c.


	Feature: "postfix status" to report whether Postfix is
	running.  By Mike Cappella.

	Cleanup: configurable address case folding moved from the
	pipe(8) delivery agent to the library, where it can also
	be used by other delivery agents. Files: global/fold_addr.[hc].


	Robustness: recommend a "0" process limit for policy servers
	to avoid "connection refused" problems when the smtpd process
	limit exceeds the default process limit.  File:


	Workaround: turn on KEEPALIVE probes to avoided "lost
	connection after sending end-of-data" problems when some
	stateful (NAT) filter expires an idle connection too soon.
	This requires that the kernel's TCP keepalive timer be set
	to a sufficiently short time (perhaps 100s or less).  Files:
	util/sane_accept.c, util/sane_connect.c.

	Safety: when IPv6 (or IPv4) is turned off, don't treat an
	IPv6 (or IPv4) connection from e.g. inetd as if it comes
	from localhost[]. Files: smtpd/smtpd_peer.c,


	Workaround: build without EPOLL support when an epoll-enabled
	kernel sits underneath a retarded libc.  File: makedefs.

	Cleanup: missing support for SASL security properties with
	Dovecot SASL authentication. Based on an initial version
	by Lev A. Serebryakov.  File: xsasl/xsasl_dovecot_server.c.


	Cleanup: changed the default address verification sender
	from "postmaster" to "double-bounce", so that the Postfix
	SMTP server no longer surprises unsuspecting people by
	excluding "postmaster" from SMTPD access controls.  File:


	Bugfix: Content-Transfer-Encoding: attribute values are
	case insensitive. File: src/cleanup/cleanup_message.c.


	Bugfix: the makedefs EPOLL workaround broke any attempt to
	build on a 2.6 kernel. And that two weeks after the workaround
	had been posted to the mailing list. File: makedefs.

	Bugfix: mailbox_transport(_maps) and fallback_transport(_maps)
	were broken when used with the error(8) or discard(8)
	transports. Cause: insufficient documentation.  Files:
	error/error.c, discard/discard.c.


	Bugfix (problem introduced Postfix 2.3): when DSN support
	was introduced it broke "agressive" recipient duplicate
	elimination with "enable_original_recipient = no".  File:


	Feature: cyrus_sasl_config_path to specify a search path
	for Cyrus SASL configuration files (currently used only to
	locate the smtpd.conf file).  Based on code by Victor
	Duchovni. Files: smtpd/smtpd.c xsasl/xsasl_cyrus_server.c,
	(and xsasl/xsasl_cyrus_client.c for future expansion).


	Bugfix (introduced 20070523): the sasl_set_path() function
	name was mis-speeled.


	Bugfix (introduced Postfix 2.3): the sendmail/postdrop
	commands would hang when trying to submit a message larger
	than the per-message size limit. File: postdrop/postdrop.c.


	Sabotage the saboteur who insists on breaking Postfix by
	adding gethostbyname() calls that cause maildir delivery
	to fail when the machine name is not found in /etc/hosts,
	or that cause Postfix processes to hang when the network
	is down.


	Portability: Victor helpfully pointed out that change
	20070425 broke on non-IPv6 systems. Files: smtpd/smtpd_peer.c,


	Isolation: don't allow the pipe(8) delivery agent to leak
	postdrop group privileges with "user=xxx:postdrop". File:


	Bugfix: the Milter client assumed that a Milter application
	does not modify the message header or envelope, after that
	same Milter application has modified the message body of
	that same email message. This is not a problem with updates
	by different Milter applications.  Problem was triggered
	by Jose-Marcio Martins da Cruz. Also simplified the handling
	of queue file update errors. File: milter/milter8.c.


	Workaround: some non-Cyrus SASL SMTP servers require SASL
	login without authzid (authoriZation ID), i.e. the client
	must send only the authcid (authentiCation ID) + the authcid's
	password.  In this case the server is supposed to derive
	the authzid from the authcid. This works as expected when
	authenticating to a Cyrus SASL SMTP server.  To get the old
	behavior specify "send_cyrus_sasl_authzid = yes", in which
	case Postfix sends the (authzid, authcid, password), with
	the authzid equal to the authcid. File: xsasl/xsasl_cyrus_client.c.


	Portability: /dev/poll support for Solaris chroot jail setup
	scripts. Files: examples/chroot-setup/Solaris8,


	The RFC documents at www.faqs.org are being polluted with
	"feedback" spam. The Postfix hypertext documentation now
	points to tools.ietf.org. File: mantools/postlink.


	Feature: updated smtp-sink with new options to send a
	pre-formatted message from file, and to handle replies other
	than the expected 2xx or 3xx. File: smtpstone/smtp-source.c.

	Cleanup: Milter client error handling, so that the (Postfix
	SMTP server's Milter client) does not get out of sync with
	Milter applications after the (cleanup server's Milter
	client) encounters some non-recoverable problem.  Files:
	milter/milter8.c, smtpd/smtpd.c.


	Support for RFC 4954 (SASL AUTH, updates RFC 2554, refines
	some reply codes and introduces DSN enhanced status codes)
	and RFC 3848 ("Received ...  with ESMTPS?A? ...). Currently,
	support for the latter is always on.  Files: smtpd/smtpd.c,
	smtpd/smtpd_sasl_proto.c, smtpd/smtpd_sasl_glue.c.


	Workaround: the queue manager no longer logs a warning for
	mail sent to the local double-bounce address (normally, the
	this is used as the sender while reporting an undeliverable
	bounce message to the local postmaster).  As of 20070503
	the local double-bounce address is the default sender for
	sender/recipient address verification probes, and it now
	shows up as a spam target. Files: *qmgr/qmgr_message.c.


	Performance: fix for poor TCP performance for loopback
	( connections. Problem reported by Mark Martinec.
	Files: util/vstream.c, util/vstream_tweak.c, milter/milter8.c,
	smtp/smtp_connect.c, smtpstone/*source.c.


	Bugfix: when a milter replied with ACCEPT at or before the
	first RCPT command, the cleanup server would apply the
	non_smtpd_milters setting as if the message was a local
	submission. Problem reported by Jukka Salmi. Also, the
	cleanup server would get out of sync with the milter when
	a milter replied with ACCEPT at the DATA command. Files:
	cleanup/cleanup_envelope.c, smtpd/smtpd.c, milter/milters.c.


	Cleanup: unlike smtpd_mumble_restrictions, the Postfix SMTP
	server Milter reject logging did not show the (helo argument,
	sender address, or recipient address) that was being rejected.
	File: smtpd/smtpd.c.


	Bugfix (introduced snapshot 20070429): the pipe(8) delivery
	agent 'q' flag (quote address local-part) used the same bit
	mask as the 'B' flag (append blank line). Setting one flag
	also turned on the other. File: pipe/pipe.c.

	Feature: specify the 'X' flag to indicate that the pipe(8)
	delivery agent performs final delivery. This changes the
	status in DSN "success" messages from "relayed" into
	"delivered".  File: pipe/pipe.c.


	Feature: stress-adaptive behavior. When a "public" network
	service runs into an "all processes are busy" condition,
	the master(8) daemon logs a warning, restarts the service,
	and runs it with "-o stress=yes" on the command line (normally
	it runs the service with "-o stress=").  This can be used
	to make main.cf parameter settings stress dependent.
	Examples: "smtpd_timeout = ${stress?10}${stress:300}" and
	"smtpd_hard_error_limit = ${stress?1}${stress:20}".  Files:
	master/master_avail.c, master/master_spawn.c, master/master_ent.c.


	Bugfix (introduced Postfix 2.2.11): TLS client certificate
	with unparsable canonical name caused the SMTP server's
	policy client to allocate zero-length memory, triggering
	an assertion that it shouldn't do such things.  File:


	Bugfix (introduced Postfix 2.4) missing initialization of
	event mask in the event_mask_drain() routine (used by the
	obsolete postkick(1) command). Found by Coverity.  File:


	Workaround: the flush daemon forces an access time update
	for the per-destination logfile, to prevent an excessive
	rate of delivery attempts when the queue file system is
	mounted with "noatime".  File: flush/flush.c.


	Cleanup: don't complain when a "corrupt" queue file is 
	deleted before it can be saved to the "corrupt" queue.
	Files: *qmgr/qmgr_active.c.


	Logging: the Postfix SMTP server now logs the number of
	bytes received after the DATA command when a connection
	breaks before mail delivery completes.  This may help finding
	the cause of the problem: packet loss, MTU, or other. File:


	Logging: all daemons now log the TCP port number of remote
	SMTP or QMQP clients.  The information is overruled with
	the SMTP XCLIENT command, is propagated through SMTP-based
	content filters with XFORWARD, and is sent to Milter
	applications.  Files: smtpd/smtpd_peer.c, smtpd/smtpd.c,
	smtpd/smtpd_proxy.c, smtpd/smtpd_milter.c, qmqpd/qmqpd_peer.c,
	cleanup/cleanup_milter.c, *qmgr/qmgr_message.c,
	*qmgr/qmgr_deliver.c, smtp/smtp_proto.c, pipe/pipe.c,
	global/deliver_request.c, global/deliver_pass.c,

	Feature: per-command delays in smtp-sink. File:
	smtpstone/smtp-sink.c.  Victor Duchovni.


	Cleanup: updated a bunch of hard-coded host[addr] logging
	statements. Files: smtpd/smtpd.c, smtpd/smtpd_chat.c,

	Cleanup: client port logging is now configurable (off by
	default). Parameters: smtpd_client_port_logging and
	qmqpd_client_port_logging. Files: smtpd/smtpd_peer.c,

	Cleanup: send client port information "0" instead of "unknown"
	to Milter applications. Files: smtpd/smtpd.c, smtpd/smtpd_milter.c,


	Portability: on Linux we no longer need /proc to find out
	local IPv6 interface address information. LaMont Jones.
	Files: util/sys_defs.h.


	Bugfix (introduced Postfix 2.3): Postfix mistakenly enforced
	the 64kbyte limit (for sending body parts TO Milter
	applications) also while receiving packets FROM Milter
	applications.  The limit is now at least 1GB.  File:


	Feature: ORIGINAL_RECIPIENT environment variable.  Corey
	Hickey. File: local/local.c.


	Feature: general-purpose header/body_checks library module,
	first used in the SMTP client. Actions that change the
	message delivery time or destination can be implemented
	with a simple extension mechanism (they make sense only in
	before-queue filters).  Configuration parameters:
	smtp_header_checks, smtp_mime_header_checks,
	smtp_nested_header_checks, smtp_body_checks. Unlike the
	cleanup server, the mime and nested header checks don't by
	default assume the header_checks value.  Files:
	global/header_body_checks.[hc], smtp/smtp_proto.c,


	Feature: ${original_recipient} command-line macro.  Corey
	Hickey. File: pipe/pipe.c.

	Bugfix (introduced: 20071004) missing exception handling
	in smtp-sink per-command delay feature. Victor Duchovni.
	File: smtpstone/smtp-sink.c.


	Revised queue manager with separate mechanisms for
	per-destination concurrency control and dead destination
	detection.  The concurrency control supports non-integer
	feedback for more gradual concurrency adjustments, and uses
	hysteresis to avoid rapid oscillations.  A destination is
	declared "dead" after a configurable number of pseudo-cohorts
	(number of deliveries equal to a destination's concurrency)
	reports connection or handshake failure. This work began
	with a discussion that Wietse started with Patrik Rak and
	Victor Duchovni late January 2004, and that Victor revived
	late October 2007. To establish a baseline for further
	improvement, Wietse implemented a few simple mechanisms.

	Configuration parameters for debugging, positive/negative
	hysteresis, and positive/negative feedback. Some have since
	been removed or renamed, so no point naming them here.
	Files: global/mail_params.h, qmgr/qmgr_queue.c,


	Boundary condition: Patrik Rak pointed out that handling
	of negative feedback with concurrency window 1 could
	be improved.

	Feature: support to look up null sender addresses in
	sender-dependent relayhost maps. Parameter name:
	empty_address_relayhost_maps_lookup_key (default; <>).
	Keean Schupke. File: trivial-rewrite/resolve.c.


	Revision 2 of queue manager scheduler interface, allowing
	feedback parameter settings with constants and variables
	such as 1/8 or 1/concurrency.  Some experimental parameters
	were removed and others were renamed. The new names are:

	Also available are transport-specific overrides:

	Files: global/mail_params.h, *qmgr/qmgr.c, *qmgr/qmgr_transport.c,
	*qmgr/qmgr_queue.c, *qmgr/qmgr_feedback.c, postconf/auto.awk.


	Feature: output rate control. For example, specify
	"smtp_destination_rate_delay = 5m" to insert a five-minute
	delay between deliveries. This was an opportunity to define
	the mutually exclusive states that a queue can have, and
	to detect invalid transitions.  This will make adding new
	features code easier.  Files: *qmgr/qmgr_transport.c,
	*qmgr/qmgr_queue.c, *qmgr/qmgr_entry.c.

	Bugfix (introduced Postfix 2.2): don't update the back-to-back
	delivery time stamp while deferring mail. File: *qmgr/qmgr_entry.c.


	Feature: support for read-write tables in the proxymap
	service. This is implemented with a separate master.cf entry
	named "proxywrite" that should run with process limit of 1
	if you want to update Berkeley DB like tables. This feature
	requires that tables be authorized with the proxy_write_maps
	configuration parameter. Files: global/dict_procy.[hc],

	Human factors: the postmap and postalias commands now produce
	nicer diagnostics when asked to do something with a proxied
	map that they can't do. Files: postmap/postmap.c,

	Bugfix: the proxymap client didn't properly propagate user
	options to the proxymap server.  File: util/dict.h.

	Workaround: force synchronous updates in the proxymap server
	so that maps will be in a consistent state between updates.
	File: proxymap/proxymap.c.

	Bugfix: an empty rate-limited queue wasn't removed after
	timer expiry. Files: *qmgr/qmgr_queue.c.


	Use different sockets for proxymap (read-only) and proxywrite
	(read-write) services in the proxy: client. Victor Duchovni.
	File: global/dict_proxy.c.

	Feature: proxymap delete support by Victor Duchovni.  Files:
	global/dict_proxy.c, proxymap/proxymap.c.

	Feature: proxymap delete support. Files: postmap/postmap.c

	Cleanup: the Postfix sendmail command did not include the
	user (name/uid) information in all error messages. File:

	Feature: data_directory configuration parameter for
	Postfix-writable data such as caches and random numbers.
	Files: postfix-install, conf/postfix-files.


	Security: tlsmgr(8) and verify(8) no longer use root
	privileges when opening their cache files. This avoids a
	potential security loophole where the ownership of a file
	(or directory) does not match the trust level of the content
	of that file (or directory). See RELEASE_NOTES for how to
	use pre-existing data. Files: util/set_eugid.[hc],
	tlsmgr/tlsmgr.c, verify/verify.c.

	Compatibility: as a migration tool, redirect attempts by
	tlsmgr(8) or verify(8) to open files in non-Postfix directories
	to the Postfix-owned data_directory. File: global/data_redirect.c.

	Lots of pathname fixes in the examples of TLS_README and
	postconf(5); -lm library screw-up in queue manager Makefiles.


	Cleanup: pathname fixes in documentation; unnecessary queue
	scan in the queue manager rate limiter; inverse square root
	feedback in the queue manager concurrency scheduler.  Files:
	mantools/postlink, proto/TLS_README.html, *qmgr/qmgr_queue.c.

	All changes up to this point should be ready for Postfix 2.5.

	Documentation: updated nqmgr preemptive scheduler documentation
	by Patrik Rak. File: proto/SCHEDULER_README.html.


	Bugfix (introduced 19980315): the "write" equivalent of
	bugfix 20030104. File: util/vstream.c.


	Feature: "stress=" or "stress=yes" attribute in the SMTPD
	policy delegation protocol. File: smtp/smtpd_check.c.

	Cleanup: allow_min_user now rejects recipients (and senders)
	starting with '-' at SMTP session time. To make this possible
	the feature was moved from qmgr(8) to trivial-rewrite(8).
	Files: *qmgr/qmgr_message.c, trivial-rewrite/resolve.c.


	Cleanup: the queue manager and SMTP client now distinguish
	between connection cache store and retrieve hints. Once the
	queue manager enables connection caching (store and load)
	hints on a per-destination queue, it keeps sending connection
	cache retrieve hints to the delivery agent even after it
	stops sending connection cache store hints.  This prevents
	the SMTP client from making a new connection without checking
	the connection cache first. Victor Duchovni.  Files:
	*qmgr/qmgr_entry.c, smtp/smtp_connect.c.

	Bugfix (introduced Postfix 2.3): the SMTP client never
	marked corrupt files as corrupt. Victor Duchovni. File:

	Cleanup: the SMTP client won't mark a destination as
	unavailable when at least one SMTP session was completed
	without connect or handshake error. Victor Duchovni. Files:
	smtp/smtp_connect.c, smtp/smtp_session.c, smtp/smtp_proto.c,


	Documentation and code cleanup. Files: global/deliver_request.h,
	*qmgr/qmgr_entry.c, smtp/smtp_connect.c,

	Bugfix (introduced snapshot 20071006): qmqpd ignored the
	qmqpd_client_port_logging parameter setting. File:


	Cleanup: show the remote SMTP server port in verbose logging,
	warnings and postmaster notices.  Still don't show the port
	in delivery status notifications. Files: smtp/smtp_chat.c,
	smtp/smtp_sasl_glue.c, smtp/smtp_sasl_proto.c.

	The "tls_require_cert" is now compatible with OpenLDAP 2.1
	and later. Victor Duchovni. Files: proto/ldap_table,


	Cleanup: removed the "#ifdef USE_LIBMILTER_INCLUDES"
	dependencies on system-installed Milter protocol include
	files. Verified that the object code has not changed. File:

	Sanity check: idiot filter to detect attempts to use the
	same database file for different TLS session caches.  File:

	Cleanup: updated the spell check stoplist and the spell
	check script. Files: mantools/spell, proto/stop.

	Cleanup: replaced documentation references to xxgdb by ddd.
	The xxgdb program hasn't been updated in more than 10 years.
	Files: proto/postconf.proto, conf/main.cf.


	Feature: support for all new Sendmail 8.14 Milter features
	except SMFIR_SKIP (skip further events of this type),
	SMFIP_RCPT_REJ (report rejected recipients to the mail
	filter), SMFIR_CHGFROM (replace sender, with optional ESMTP
	command parameters), and SMFIR_ADDRCPT_PAR (add recipient,
	with optional ESMTP command parameters). Files: milter/milters.c,
	milter/milter8.c, milter/test-milter.c, cleanup/cleanup_milter.c.


	Feature: support for Sendmail 8.14 Milter SMFIR_SKIP (skip
	further events of this type). Files: milter/milter8.c,

	Cleanup: don't try sending HELO after a 421 EHLO reply.
	File: smtp/smtp_proto.c.


	Using 20071221 as reference point.

	Cleanup: Simplified TLS library cipher and protocol API to
	just pass string-valued properties to tls_client_init() and
	tls_client_start(). The client is now agnostic of the
	mechanics of cipher management internal to the library. The
	main.cf parameters used internally in the library are now
	loaded by the library, not the caller. Files:
	src/smtp/lmtp_params.c, src/smtp/smtp.c, src/smtp/smtp.h,
	src/smtp/smtp_params.c, src/smtp/smtp_proto.c,
	src/smtp/smtp_session.c, src/smtpd/smtpd.c, src/tls/tls.h,
	src/tls/tls_client.c, src/tls/tls_level.c, src/tls/tls_misc.c,
	src/tls/tls_server.c, src/tls/tls_session.c, src/tls/tls_verify.c
	and src/tlsmgr/tlsmgr.c

	Cleanup: Client session lookup key "salting" is now handled
	internally in the tls library. Files: src/tls/tls_client.c

	Cleanup: Cipher state is cached, and only updated when
	necessary.  Files: src/tls/tls_misc.c

	Feature: Extended the syntax of protocol selection to allow
	exclusions as well as inclusions. Files: src/tls/tls_misc.c

	Cleanup: Updated default verification depth to match reality:
	default is 9 in OpenSSL and we don't yet override it.  When
	we do (soon), the default will match previous behavior.
	Files: src/global/mail_params.h

	Bugfix: Reference to obsolete "pfixtls" code won't compile
	inside #ifdef for OpenSSL <= 0.9.5a. Using an OpenSSL release
	that old has not been tested for some time, but may now
	work. Files: src/tls/tls_bio_ops.c.

	Replaced "void *" TLS library application handles by explicit
	pointer types, while hiding data structure implementation
	details from the TLS library users. Files: tls/tls_client.c,
	tls/tls_server.c, smtp/smtp.c, smtpd/smtpd.c.

	The TLS library no longer modifies VSTRINGs passed in by
	the caller. Where possible, information is passed as "const"
	from application to library. Files: smtp/smtp_proto.c,


	Replaced explicit initialization of props structures by
	emulating function calls with named parameter lists.  Files:
	tls/tls.h, smtp/smtp.c, smtp/smtp_proto.c, smtpd/smtpd.c.


	Further polishing of the Milter code and logging. File:


	Further polishing of the Milter code. With SETSYMLIST, each
	Milter can now update its own macros instead of clobbering
	the global copy that is shared with other Milters. Also an
	opportunity to clean up some ad-hoc code for sending macro
	lists from smtpd(8) to cleanup(8). Files: milter/milter.c,
	milter/milter8.c, milter/milter_macros.c.


	Further polishing of the Milter code. Eliminated unnecessary
	steps from the initial smtpd/cleanup Milter handshake. Files:
	milter/milter.c, milter/milter8.c, milter/milter_macros.c.

	Cleanup: name_code(3) and name_mask(3) now support read-only
	tables. Files: util/name_code.[hc], util/name_mask.[hc].


	Cleanup: further refinements of the Milter code, allowing
	for multiple macro overrides. The code is now ready for
	serious testing. File: milter/milter8.c.


	Bugfix: the Milter client did not replace the Postfix-specific
	form for unknown host names by the Sendmail-specific form.
	File: milter/milter8.c.

	Cleanup: when a cleanup milter reports a problem don't log
	generic "4.3.0 Sevice unavailable", but log the text for
	the actual error. File: cleanup/cleanup_milter.c.


	SMTP client fingerprint security level support and configurable
	fingerprint digest algorithm. Victor Duchovni. Files:
	smtp/lmtp_params.c, smtp/smtp.c, smtp/smtp.h,
	src/smtp/smtp_params.c, src/smtp/smtp_proto.c,
	src/smtp/smtp_session.c, tls/tls_client.c, tls/tls_level.c,


	Missed "invalid TLS configuration" patch for SMTP client.
	Victor Duchovni. File: smtp/smtp_proto.c.

	SMTP server configurable fingerprint digest algorithm.
	Victor Duchovni. Files: smtpd/smtpd.c, tls/tls.h,
	tls/tls_server.c, tls/tls_verify.c.


	Cleanup: finally implemented certificate verification depth
	limit parameters. Prior to Postfix 2.5 these were ignored.
	For backwards compatibility, the default verification depth
	limit is now 9, the OpenSSL default. Victor Duchovni. Files:
	src/tls/tls_client.c, src/tls/tls_server.c, src/tls/tls_verify.c.

	Robustness: Avoid possibility of NULL pointer issues in
	application code that checks certificate names, by providing
	"empty string" values when no data is available.  Victor
	Duchovni.  Files: src/tls/tls_verify.c, src/tls/tls_client.c,
	src/tls/tls_server.c, src/smtpd/smtpd_check.c, src/smtpd/smtpd.c.

	Cleanup: separation of TLS handshake from security level
	enforcement. The library shakes hands; the application
	decides if the resulting security is acceptable. Victor
	Duchovni.  Files: smtpd/smtpd.c, smtpd/smtpd_proto.c,
	tls/tls_server.c, tls/tls_client.c, tls/tls_verify.c.

	Robustness: more robust processing of ASN.1 string attributes
	in x509v3 certificates, plus additional sanity checks (e.g.
	embedded null characters). Victor Duchovni. File:


	Workaround: minor change to the Dovecot AUTH request to
	prevent dovecot-auth memory wastage. Timo Sirainen.  File:


	Cleanup: renamed TLS-related symbols for consistency (always
	include the init, start, stop prefix in the TLS library
	function and data structure names; consistently distinguish
	between per-application TLS state and per-session TLS state;
	consistently use the fpt prefix for fingerprint related
	variables and structure members; consistent use of monocase
	typedef-ed names).


	Cleanup: consistent use of <pre> and <blockquote> in examples;
	instead of emphasizing new Postfix 2.5 behavior in reference
	documentation, describe the new behavior as "current", with
	historical behavior as a supplemental note.


	Feature: new "pass" service type (in addition to "inet",
	"unix" and "fifo").  The "pass" service type supports
	front-end daemons that accept all inbound connections and
	that permit only well-behaved clients to talk to the MTA.
	This service type had been sitting in the master daemon for
	years but was disabled by default.  Actual applications for
	this will have to be developed later.  Files: util/upass_connect.c,


	Cleanup: where possible, store data structures in read-only
	memory. Besides the security advantage of no write access,
	this also gives slightly better memory utilization when
	many processes execute the same file. Files: pretty much
	everything that has a static table, except for a few tables
	in the benchmark tools with flags that are controlled by
	command-line information.


	Cleanup: more read-only data. Files: everything that passes
	around a HEADER_OPTS pointer.


	Safety: optional lookup table to prevent the Postfix SMTP
	client from making repeated SASL login failures with the
	same hostname, username and password.  This introduces new
	parameters: smtp_sasl_auth_cache_name, smtp_sasl_auth_cache_time.
	Based on code by Keean Schupke.  Files: smtp/smtp_sasl_glue.c,

	Safety: the Postfix SMTP client now by default defers mail
	after the server rejects a SASL login attempt with a 535
	status code.  Specify "smtp_sasl_auth_soft_bounce = no" to
	get the earlier behavior.  Based on code by Keean Schupke.
	Files: smtp/smtp_sasl_glue.c.


	Safety: the smtpd_client_new_tls_session_rate_limit setting
	now also limits the number of failed TLS handshakes. This
	limits the impact of broken configurations. File: smtpd/smtpd.c.


	Bugfix (introduced 20080112): Patrik Rak found two bugs
	that largely canceled each other out, causing Postfix not
	to complain about a missing "proxy:" prefix with the new
	smtp_sasl_auth_cache_name parameter setting. File:

	Documentation: new SOHO_README file for small/home offices.
	The text is automatically generated from bits and pieces of
	information that are scattered across other documents.
	File: mantools/make_soho_readme.


	Bugfix (introduced 20080112): missing #ifdef for the SASL
	login failure cache. File: smtp/smtp_sasl_auth_cache.h.


	Name fix: renamed the mumble_delivery_rate_delay parameter
	to mumble_destination_rate_delay, because it really is a
	per-destination feature. With this change we keep the option
	of implementing a future per-transport rate delay.


	Bugfix (introduced 20071216): missing {} in the LDAP client
	broke OpenLDAP TLS.  The setting tls_require_cert=no was
	further broken because Postfix used OpenLDAP incorrectly.
	Victor Duchovni.  This broke tls_require_cert=no File:


	Bugfix (introduced 20071204): wrong proxywrite process limit
	in the default master.cf file.  File: conf/master.cf.


	Workaround: pick up a missing data_directory setting from
	main.cf when "postfix start" is invoked with an obsolete
	postfix command. File: conf/post-install.


	Cleanup: soft_bounce support for multi-line Milter replies.
	File: src/milter/milter8.c.

	Cleanup: preserve multi-line format of header/body Milter
	replies. Files: cleanup/cleanup_milter.c, smtpd/smtpd.c.

	Cleanup: multi-line support in SMTP server replies.  File:


	Safety: break SASL loop in case both the SASL library and
	the remote SMTP server are confused. File: smtp/smtp_sasl_glue.c.


	Safety: the master daemon now sets an exclusive lock on a
	file $data_directory/master.lock, so that the data directory
	can't be shared between multiple Postfix instances.  This
	would corrupt files that rely on single-writer updates
	(examples: verify(8) cache, tlsmgr(8) caches, etc.). File:


	Bugfix: bounce(8) segfault on one-line template text.
	Problem found by Sacha Chlytor. File: bounce/bounce_template.c.


	Safety: the SMTP server's Dovecot authentication client now
	enforces the SASL mechanism output filter also on client
	command input. File: src/xsasl/xsasl_dovecot_server.c.


	Bugfix (introduced 20070811): the MAIL and RCPT Milter
	application call-backs no longer received {mail_addr} or
	{rcpt_addr} information. Problem reported by Anton Yuzhaninov.
	File: smtpd/smtpd.c.


	Human factors: the PCRE and regexp maps now give more
	comprehensible error messages when people make the common
	mistake of indenting if/endif blocks. Files: util/dict_pcre.c,


	Bugfix (introduced Postfix 2.0): after "warn_if_reject
	reject_unlisted_recipient/sender", the SMTP server mistakenly
	remembered that recipient/sender validation was already
	done. File: smtpd/smtpd_check.c.

	Bugfix (introduced Postfix 2.3): the queue manager would
	initialize missing client logging attributes (from xforward)
	with real client attributes. Fix: enable this backwards
	compatibility feature only with queue files that don't
	contain logging attributes. Problem reported by Liviu Daia.
	Files *qmgr/qmgr_message.c.


	Cleanup: some warning messages said "regexp" or "regexp
	map" instead of "pcre map". File: util/dict_pcre.c.


	Cleanup: the proxy_read_maps (Postfix 2.0) default setting
	was not updated when adding sender/recipient_bcc_maps
	(Postfix 2.1) and smtp/lmtp_generic_maps (Postfix 2.3).
	File: global/mail_params.h.

	Cleanup: the SMTP server's XFORWARD and XCLIENT support was
	not updated when the smtpd_client_port_logging configuration
	parameter was added. Code by Victor Duchovni. Files:
	smtpd/smtpd.c, smtpd/smtpd_peer.c.


	Bugfix: null-terminate CN comment string after sanitization.
	File: smtpd/smtpd.c.


	Workaround: avoid "bad address pattern" errors with non-address
	patterns in namadr_list_match() calls. File: util/match_ops.c.


	Bugfix (introduced 20080207): "cleanup -v" panic because
	the new "SMTP reply" request flag did not have a printable
	name. File: global/cleanup_strflags.c.

	Cleanup: using "Before-queue content filter", RFC3848
	information was not added to the headers. Carlos Velasco.
	File smtpd/smtpd.c.


	Cleanup: a poorly-implemented integer overflow check for
	TCP MSS calculation had the unexpected effect that people
	broke Postfix on LP64 systems while attempting to silence
	a compiler warning.  File: util/vstream_tweak.c.


	Paranoia: defer delivery when a mailbox file is not owned
	by the recipient. Requested by Sebastian Krahmer, SuSE.
	Specify "strict_mailbox_ownership=no" to ignore ownership
	discrepancies.  Files: local/mailbox.c, virtual/mailbox.c.


	Bugfix: dangling pointer in vstring_sprintf_prepend().
	File: util/vstring.c.


	Security: some systems have changed their link() semantics,
	and will hardlink a symlink, contrary to POSIX and XPG4.
	Sebastian Krahmer, SuSE. File: util/safe_open.c.

	The solution introduces the following incompatible change:
	when the target of mail delivery is a symlink, the parent
	directory of that symlink must now be writable by root only
	(in addition to the already existing requirement that the
	symlink itself is owned by root).  This change will break
	legitimate configurations that deliver mail to a symbolic
	link in a directory with less restrictive permissions.


	Bugfix (introduced Postfix 2.4): epoll file descriptor leak.
	With Postfix >= 2.4 on Linux >= 2.6, Postfix has an epoll
	file descriptor leak when it executes non-Postfix commands
	in, for example, user-controlled $HOME/.forward files.  A
	local user can access a leaked epoll file descriptor to
	implement a denial of service attack on Postfix. Data
	confidentiality and integrity are not affected.  File: