Postfix 2.2 Patch 09

Postfix 2.2.9 was released a few days ago. This is mostly a collection
of back-ported fixes from the Postfix 2.3 development branch.

Most of this patch hardens the TLS implementation against DNS-based
attacks, and eliminates some anomalies from the TLS per-site policy
engine. See the TLS_README document for tips on how to avoid
DNS-based attacks that can change the server hostname that Postfix
uses for logging, for TLS per-site policies, and for server
certificate verification.

The patch also adds a workaround that prevents Postfix from repeatedly
trying to deliver mail to domains with a malformed MX record (for
example, with a null MX hostname). Postfix 2.2.9 bounces such mail
immediately.

Available from the mirrors listed at http://www.postfix.org/download.html

    36105 Feb 21 16:36 postfix-2.2-patch09.gz
   373935 Feb 21 16:24 postfix-2.2.9.HISTORY
    19753 Mar  9  2005 postfix-2.2.9.RELEASE_NOTES
  2442158 Feb 21 16:38 postfix-2.2.9.tar.gz
      280 Feb 21 16:38 postfix-2.2.9.tar.gz.sig

A detailed change log can be found below the signature.

	Wietse

20010604

	Safety: new "smtp_cname_overrides_servername" parameter.
	The default value ("yes") is backwards compatible.

	With a value of "no", the Postfix SMTP client no longer
	allows CNAME expansion to override the hostname that is
	used for logging, SASL password lookup, TLS policy decisions,
	or TLS certificate verification.  Instead it uses the name
	of the recipient domain, the host or domain name specified
	in Postfix configuration files, or the hostnames obtained
	with MX lookups. To prevent cheating with hostnames in MX
	lookup results, you will have to suppress MX lookups with
	explicit [hostname] entries in transport maps. Files:
	dns/dns_lookup.c, dns/dns_rr.c, proto/postconf.proto.

20060108

	Bugfix: mailbox_command_maps was not subject to $name
	expansion. File: local/local.c.

20060115

	Bugfix: don't ignore the per-site policy when SSL library
	initialization fails. Introduced after adopting the TLS
	patch. File: smtp/smtp_session.c.

20060121

	Bugfix: a TLS per-site MUST_NOPEERMATCH policy could not
	override a stronger main.cf policy, while a per-site NONE
	policy could. Fixed with a clean re-implementation from
	Postfix 2.3.  File: smtp/smtp_session.c.

	Bugfix: a combined TLS per-site (host, recipient) policy
	of (NONE, MAY) changed a global MUST policy into NONE, and
	a global MUST_NOPEERMATCH into MAY. The result is now NONE.
	Problem found by exhaustive simulation. Fixed with a clean
	re-implementation from Postfix 2.3.  File: smtp/smtp_session.c.

20060130

	Bugfix: an empty remote_header_rewrite_domain value caused
	trivial-rewrite to dereference a null pointer, but only in
	regression tests, not in production.  Postfix rewrites
	addresses in the remote rewriting context only when the
	remote_header_rewrite_domain parameter value is non-empty.
	File: trivial-rewrite/rewrite.c.

20060202

	Workaround: a malformed domain name lookup result (such as
	null MX record) is now treated as a hard error, so that
	Postfix will no longer repeatedly try to deliver mail until
	the message expires in the queue.  However, this will not
	reject mail with reject_unknown_sender/recipient_domain.
	That would require too much change for a stable release.
	File: dns/dns_lookup.c.

20060203

	Bugfix: smtpd core dump when SASL is compiled in, turned
	off (smtpd_sasl_auth_enable = no) and permit_sasl_authenticated
	is specified in local_header_rewrite_clients. Victor Duchovni.
	File: smtpd/smtpd_check.c.

20060204

	Bugfix: disable the content_filter feature for user-requested
	"sendmail -bv" probes, just like it is disabled for probes
	generated by Postfix itself.  File: *qmgr/qmgr_message.c.

20060212

	Workaround: don't consume in_flow tokens when incoming mail
	is placed on hold. Back-ported from Postfix 2.3. File:
	cleanup/cleanup_api.c.