Postfix attempts to be fast, easy to administer, and secure, while at the same
time being sendmail compatible enough to not upset existing users. Thus, the
outside has a sendmail-ish flavor, but the inside is completely different.
Some features:
Connection cache for SMTP, DSN status notifications, IP version 6, Plug-in
support for multiple SASL implementations (Cyrus, Dovecot), TLS encryption and
authentication, Configurable status notification message text, Access control
per client/sender/recipient/etc, Content filter (built-in, external before
queue, external after queue), Berkeley DB database, LDAP database, MySQL
database, PostgreSQL database, Maildir and mailbox format, Virtual domains,
VERP envelope return addresses and others.
===> The following configuration options are available for postfix-3.11.7_4,1:
BDB=off: Berkeley DB support
BLOCKLISTD=on: Enable blocklistd support
CDB=on: CDB maps lookups
DOCS=on: Build and/or install documentation
EAI=on: Email Address Internationalization (SMTPUTF8) support
INST_BASE=off: Install into /usr and /etc/postfix
LDAP=off: LDAP maps (uses WITH_OPENLDAP_VER)
LMDB=on: LMDB maps
MONGO=off: MongoDB support
MYSQL=off: MySQL database support
NIS=off: Network Information Services/YP support
PCRE2=on: Use Perl Compatible Regular Expressions, version 2
PGSQL=off: PostgreSQL database support
SASL=off: Cyrus SASL support (Dovecot SASL is always built in)
SQLITE=off: SQLite database support
TEST=off: SMTP/LMTP test server and generator
TLS=on: Secure network connection support via TLS
TLSRPT=on: Enable sending RFC 8460 TLS reports
====> LMDB version to use: you can only select none or one of them
LMDB0=on: Use LMDB 0.9 library
LMDB1=off: Use LMDB 1.0 library
====> Kerberos network authentication protocol type: you can only select none or one of them
SASLKMIT=off: If your SASL req. MIT Kerberos5, select this
SASLKRB5=off: If your SASL req. Kerberos5, select this
===> Use 'make config' to modify these settings
Reason:
mail/postfix now can depend on either databases/lmdb0 or databases/lmdb.
The default is lmdb0 for now.
If you want/need to use lmdb1, you will need to build the package
with apropriate lmdb version selected.
Reason:
Postfix 3.6 and higher requires minimum OpenSSL 1.1.1
FreeBSD 11 users using base OpenSSL can switch to
mail/postfix35
If you wish to use postfix35 until FreeBSD 11 EoL you might run the
following command:
# pkg set -o mail/postfix:mail/postfix35
# pkg upgrade
port moved here from mail/postfix35 on 2021-09-30 REASON: Has expired: It is only here until FreeBSD 11 is EoL (Postfix >= 3.6 requires OpenSSL >= 1.1.x)
Number of commits found: 418 (showing only 100 on this page) #
databases/lmdb: allow to install both 0.x and 1.x together
LMDB 1.0 and the legacy 0.9 ABI cannot be mixed, the datanase format are
incompatibles as well.
Rename or relocate everything databases/lmdb0 installs so that it no
longer overlaps with databases/lmdb:
- the utilities are now mdb_copy0, mdb_dump0, mdb_load0 and mdb_stat0
- the header is include/lmdb0/lmdb.h
- the linker name is liblmdb0.so, the shared object keeps its ABI name
liblmdb.so.0 so already linked programs are unaffected
- the pkg-config file is lmdb0.pc
A compatibility prefix holding the previous layout is also installed
under ${PREFIX}/lmdb0/ (include/, lib/ and libdata/pkgconfig/) so that
build systems which expect to find lmdb.h and -llmdb relative to a
single directory only need a path change.
Now all ports should migrate to lmdb 1.X and use the lmdb 0.9 port to ease
in the migration path, lmdb, the lmdb 0.x is supposed to get removed at
some point.
Approved by: mat (portmgr)
Reviewed by: mat
Differential Revision: https://reviews.freebsd.org/D60741
mail/postfix: Depend on databases/lmdb
As the breaking change introduced in lmdb 1.0.0 has been reverted
since lmdb 1.0.1, change the dependency back to databases/lmdb
And while here, also replace the hardwired include and library
paths and named with pkgconfig.
databases/lmdb0: Add port for LMDB 0.9.x legacy ABI
LMDB 1.0 introduced an incompatible on-disk format change and subtle
API breakage: applications that compiled cleanly against 1.0 headers
could fail silently at run time. Known affected ports include dns/knot3,
mail/bogofilter, and mail/postfix; the postfix issue has been confirmed
upstream. Linux distributions such as Arch Linux have observed the same
breakage. Samba can also be affected in certain configurations.
Because the regression is not detectable in an -exp build run -- the
postfix failure only manifests at run time, and bogofilter was caught
only because post-build self-tests happen to exercise this path -- we
cannot rely on package builds to validate the 1.0 upgrade.
This commit introduces databases/lmdb0 as a holding port for the 0.9.35
(Only the first 15 lines of the commit message are shown above )
mail/postfix: Use BLOCKLIST instead of BLACKLIST
- Starting from FreeBSD version 1500000, prefer the new blocklist
nomenclature.
- Enable TLSRPT by default
PR: 294083
mail/postfix: Enable CDB and LMDB by default
Adding these solves a cross-compatibility problem with Linux distros
that have dropped bdb support. Per Postfix's document[1] on it, lmdb
and cdb are the replacements for hash and btree, respectively.
[1] http://www.postfix.org/NON_BERKELEYDB_README.html
PR: 293852
mail/postfix: Update to 3.11.1
This update brings some possibly breaking changes:
- Postfix 3.11.0:
- TLS
- smtp_tls_security_level now defaults to "may" when Postfix is built with
TLS support and compatibility_level >= 3.11
- RFC 8689 REQUIRETLS support added: requires strong authentication
(DANE/STS) from all servers in the forward path that announce REQUIRETLS
- TLS logging now includes desired vs. actual security level enforcement
status and REQUIRETLS policy enforcement details
- New smtp_tls_enforce_sts_mx_patterns parameter (default: yes) ensures
MX hostname matching for MTA-STS
(Only the first 15 lines of the commit message are shown above )
mail/postfix: Fix build on 15.0 with SASLKRB5
Kerberos in 15.0 does not provide the old libraries.
PR: 291605
Reported by: Christian Hennig <zeha@ccsej.de>
mail/postfix: Update to 3.10.3
And while here, also address some blacklistd-related improvements,
namely in postscreen and relay check.
PR: 287463
Co-authored-by: bc979@lafn.org
mail/postfix: Update to 3.8.4
This release adds support to defend against an email spoofing attack
(SMTP smuggling) on recipients at a Postfix server. For background, see
https://www.postfix.org/smtp-smuggling.html.
mail/postfix: Update to 3.8.0
The most notable change is that starting from 3.8.0, postfix
supports SRV DNS records lookups in SMTP and LMTP clients.
Release announcement:
https://www.postfix.org/announcements/postfix-3.8.0.html
Mk/**ldap.mk: Convert USE_LDAP to USES=ldap
Convert the USE_LDAP=yes to USES=ldap and adds the following features:
- Adds the argument USES=ldap:server to add openldap2{4|5|6}-server as
RUN_DEPENDS
- Adds the argument USES=ldap<version> and replaces WANT_OPENLDAP_VER
- Adds OPENLDAP versions in bsd.default-versions.mk
- Adds USE_OPENLDAP/WANT_OPENLDAP_VER in Mk/bsd.sanity.mk
- Changes consumers to use the features
Reviewed by: delphij
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D38233
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
mail: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ashish@FreeBSD.org>
* Aaron Dalton <aaron@FreeBSD.org>
* Adam David <adam@FreeBSD.org>
* Adam McDougall <mcdouga9@egr.msu.edu>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Akinori MUSHA aka knu <knu@idaemons.org>
* Alex Deiter <tiamat@komi.mts.ru>
* Alex Dupre <ale@FreeBSD.org>
* Alex Dupre <sysadmin@alexdupre.com>
* Alex Perel <veers@disturbed.net>
(Only the first 15 lines of the commit message are shown above )
*/*: Remove redundant '-[0-9]*' from CONFLICTS_INSTALL
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Approved by: portmgr (blanket)
mail/postfix: Check for supported OpenSSL version
- Check if OpenSSL at least 1.1.1a is being used
- LibreSSL is not supported as it dos not (yet) provide the
TLSv1.3 API found in OpenSSL 1.1.1 API.
- update to 3.5.9
========
20210116
Feature: when a Postfix program makes a DNS query that
requests DNSSEC validation (usually for Postfix DANE support)
but the DNS response is not DNSSEC validated, Postfix will
send a DNS query configured with the "dnssec_probe" parameter
to determine if DNSSEC support is available, and logs a
warning if it is not. By default, the probe has type "ns"
and domain name ".". The probe is sent once per process
lifetime. Files: dns/dns.h, dns/dns_lookup.c, dns/dns_sec.c,
test_dns_lookup.c, global/mail_params.[hc], mantools/postlink.
The makedefs script no longer disables DNSSEC when Postfix
is built with libc-musl. Instead Postfix will rely on the
new dnssec_probe feature, and will log a warning when Postfix
requests DNSSEC validation, but the infrastructure does not
validate DNSSEC signatures. File: makedefs.
The default "smtp_tls_dane_insecure_mx_policy = dane" was
causing unnecessary dnssec_probe activity. The default is now
"dane" when smtp_tls_security_level is "dane", otherwise it is
"may". File: global/mail_params.h.
- update to 3.5.6
20200726
Bugfix (introduced: Postfix 3.5.5): part of a memory leak
fix was backported to the wrong place. File: tls/tls_misc.c.
The Postfix 3.5.5 workaround did not explicitly override
the system-wide OpenSSL configuration of allowed TLS protocol
versions, for sessions where the remote SMTP client sends
SNI. It's better to be safe than sorry. File: tls/tls_server.c.
PR: 248271
Reported by: many
- update to 3.5.3
Changelog:
20200530
Bugfix (introduced: Postfix 3.1): "postfix tls deploy-server-cert" did not
handle a missing optional argument.
20200610
Bugfix (introduced: Postfix 3.4): in the Postfix SMTP server, the SNI
callback reported an error when it was called a second time. This happened
after the server-side TLS engine sent a TLSv1.3 HelloRetryRequest (HRR) to
a remote SMTP client.
MFH: 2020Q2
- update to 3.4.10
- adjust PORTSCOUT to include 3.5.x
- remove deprecated ports from CONFLICTS_INSTALL
- add BLACKLISTD to OPTIONS_DEFAULT
- MYSQL_USES s/=/?=/ to allow testbuild without
defining XX MYSQL dedicated make.conf's in poudriere
Update Postfix to 3.4.9 (bugfix-only release)
While here, also strip libexec/postfix/postlogd.
Announcement: http://www.postfix.org/announcements/postfix-3.4.9.html
Fixed in all supported stable releases:
Bug (introduced: Postfix 3.1): smtp_dns_resolver_options were broken while
adding support for negative DNS response caching in postscreen. Postfix was
inadvertently changed to call res_query() instead of res_search(). Reported by
Jaroslav Skarvada.
Bug (introduced: Postfix 2.5): Postfix ignored the CONNECT macro overrides
from a Milter application. Postfix now evaluates the Milter macros for an SMTP
CONNECT event after the Postfix-to-Milter connection is negotiated. Problem
reported by David Burgin.
Bug (introduced: Postfix 3.0): sanitize (remote) server responses before
storing them in the verify database, to avoid Postfix warnings about malformed
UTF8. Found during code maintenance.
PR: 243879
Submitted by: Juraj Lutter <juraj@lutter.sk>
Approved by: maintainer timeout 15d (ohauer@)
MFH: 2020Q1 (patchlevel upgrade with only bugfixes)
Differential Revision: https://reviews.freebsd.org/D23502
