Postfix attempts to be fast, easy to administer, and secure, while at the same
time being sendmail compatible enough to not upset existing users. Thus, the
outside has a sendmail-ish flavor, but the inside is completely different.
Some features:
Connection cache for SMTP, DSN status notifications, IP version 6, Plug-in
support for multiple SASL implementations (Cyrus, Dovecot), TLS encryption and
authentication, Configurable status notification message text, Access control
per client/sender/recipient/etc, Content filter (built-in, external before
queue, external after queue), Berkeley DB database, LDAP database, MySQL
database, PostgreSQL database, Maildir and mailbox format, Virtual domains,
VERP envelope return addresses and others.
===> The following configuration options are available for postfix-3.11.7_4,1:
BDB=off: Berkeley DB support
BLOCKLISTD=on: Enable blocklistd support
CDB=on: CDB maps lookups
DOCS=on: Build and/or install documentation
EAI=on: Email Address Internationalization (SMTPUTF8) support
INST_BASE=off: Install into /usr and /etc/postfix
LDAP=off: LDAP maps (uses WITH_OPENLDAP_VER)
LMDB=on: LMDB maps
MONGO=off: MongoDB support
MYSQL=off: MySQL database support
NIS=off: Network Information Services/YP support
PCRE2=on: Use Perl Compatible Regular Expressions, version 2
PGSQL=off: PostgreSQL database support
SASL=off: Cyrus SASL support (Dovecot SASL is always built in)
SQLITE=off: SQLite database support
TEST=off: SMTP/LMTP test server and generator
TLS=on: Secure network connection support via TLS
TLSRPT=on: Enable sending RFC 8460 TLS reports
====> LMDB version to use: you can only select none or one of them
LMDB0=on: Use LMDB 0.9 library
LMDB1=off: Use LMDB 1.0 library
====> Kerberos network authentication protocol type: you can only select none or one of them
SASLKMIT=off: If your SASL req. MIT Kerberos5, select this
SASLKRB5=off: If your SASL req. Kerberos5, select this
===> Use 'make config' to modify these settings
Reason:
mail/postfix now can depend on either databases/lmdb0 or databases/lmdb.
The default is lmdb0 for now.
If you want/need to use lmdb1, you will need to build the package
with apropriate lmdb version selected.
Reason:
Postfix 3.6 and higher requires minimum OpenSSL 1.1.1
FreeBSD 11 users using base OpenSSL can switch to
mail/postfix35
If you wish to use postfix35 until FreeBSD 11 EoL you might run the
following command:
# pkg set -o mail/postfix:mail/postfix35
# pkg upgrade
port moved here from mail/postfix35 on 2021-09-30 REASON: Has expired: It is only here until FreeBSD 11 is EoL (Postfix >= 3.6 requires OpenSSL >= 1.1.x)
Number of commits found: 418 (showing only 100 on this page) #
- update to postfix-3.3.4
Changelog:
20190312
Bugfix (introduced: Postfix 2.2): reject_multi_recipient_bounce
has been producing false rejects starting with the Postfix
2.2 smtpd_end_of_data_restrictons, and for the same reasons,
did the same with the Postfix 3.4 BDAT command. The latter
was reported by Andreas Schulze. File: smtpd/smtpd_check.c.
20190328
Bugfix (introduced: Postfix 3.0): LMTP connections over
UNIX-domain sockets were cached but not reused, due to a
cache lookup key mismatch. Therefore, idle cached connections
could exhaust LMTP server resources, resulting in two-second
pauses between email deliveries. This problem was investigated
by Juliana Rodrigueiro. File: smtp/smtp_connect.c.
- update to 3.3.3
Changelog:
20181202
Bugfix (introduced: postfix-2.11): with posttls-finger,
connections to unix-domain servers always resulted in "Failed
to establish session" even after a connection was established.
Jaroslav Skarva. File: posttls-finger/posttls-finger.c.
20181227 (a forgotten bugfix from 20180707)
Bugfix (introduced: Postfix 3.0): with smtputf8_enable=yes,
table lookups could casefold the search string when searching
a lookup table that does not use fixed-string keys (regexp,
pcre, tcp, etc.). Historically, Postfix would not case-fold
the search string with such tables. File: util/dict_utf8.c.
20190217
Cleanup: when the master daemon runs with PID=1 (init mode),
reap orhpan processes from non-Postfix code running in the
same container, instead of terminating with a panic. File:
master/master_spawn.c.
MFH: 2019Q1
- update to 3.3.2
Changelog:
20180617
Bugfix (introduced: Postfix 2.11): minor memory leak when
minting issuer certs. This affects a tiny minority of use
cases. Viktor Dukhovni, based on a fix by Juan Altmayer
Pizzorno for the ssl_dane library.
20180817
Workaround: postconf build did not abort if the m4 command
is not installed (on a system that does have the make
command, the awk command, the perl command, and the C
compiler?!).
(Only the first 15 lines of the commit message are shown above )
Remove compatibility code for FreeBSD < 11.2 from all ports.
Simplify some ports where DragonFlyBSD no longer needs to be special-cased.
Submitted by: rene
Reviewed by: bapt, jbeich
Differential Revision: https://reviews.freebsd.org/D17724
- fix build agains maraidb100 [1]
Firt definition of MARIADB_VERSION_ID can be found in mariadb102
therefore we have to use MARIADB_BASE_VERSION which is defined in
mariadb55 and mariadb10x
PR: 226266 [1], 220224
Reported by: Zilon [1]
- update to 3.2.5
- license is now dual (see Changelog 20180127)
- make EAI optional but on by default [1]
Changelog:
20171116
Bugfix (introduced: Postfix 2.1): don't log warnings
that some restriction returns OK, when the access map
DISCARD feature is in effect. File: smtpd/smtpd_check.c.
20171215
Bugfix (introduced: 20170611): the DB_CONFIG bugfix broke
Berkeley DB configurations with a relative pathname. File:
util/dict_db.c.
(Only the first 15 lines of the commit message are shown above )
Update to 3.2.4
Changelog:
* DANE interoperability. Postfix builds with OpenSSL 1.0.0 or 1.0.1
failed to send email to some sites with "TLSA 2 X X" DNS records
associated with an intermediate CA certificate. Problem report and
initial fix by Erwan Legrand.
* Missing dynamicmaps support in the Postfix sendmail command. This
broke authorized_submit_users settings that use a dynamically-loaded
map type. Problem reported by Ulrich Zehl.
PR: 223804
Submitted by: zeising
Approved by: maintainer timeout
mail/postfix: use ECHO_CMD instead of ECHO
- When using "make -s install" the build can fail because the
essential modifications to the port build are not made correctly.
# make -s VECHO
true
# make -s VECHO_CMD
echo
PR: 222988
Submitted by: Franco Fichtner <franco@opnsense.org>
Approved by: ohauer (maintainer timeout)
- update to 3.2.3
Changelog:
20170620
Bugfix (introduced: Postfix 3.2) extension propagation was
broken with "recipient_delimiter = .". This change reverts
a change that was trying to be too clever. Files:
global/mail_adr_crunch.c, global/mail_addr_crunch.ref.
20170910
Safety: restore sanity checks for dynamically-specified
width and precision in format strings (%*, %.*, and %*.*).
These checks were lost with the Postfix 3.2.2 rewrite of
the vbuf_print formatter. File: vbuf_print.c.
20170923
Bugfix (introduced: Postfix 3.2): panic in the postqueue
command after output write error while listing the queue.
This change restores a write error check that was lost with
the Postfix 3.2.2 rewrite of the vbuf_print formatter.
Problem reported by Andreas Schulze. File: util/vbuf_print.c.
- update to 3.2.2
- adjust PORTSCOUT
Changelog:
20170221
Compatibility fix (introduced: Postfix 3.1): some Milter
applications do not recognize macros sent as {name} when
macros have single-character names. Postfix now sends such
macros without {} as it has done historically. Viktor
Dukhovni. File: milter/milter.c.
20170402
Bugfix (introduced: Postfix 3.2): restore the SMTP server
receive override options at the end of an SMTP session,
after the options may have been modified by an smtpd_milter_maps
(Only the first 15 lines of the commit message are shown above )
Update to 3.2.0.
This release ends support for legacy release Postfix 2.10.
The main changes in no particular order are:
* Elliptic curve negotiation with OpenSSL [?] 1.0.2. This changes the default
smtpd_tls_eecdh_grade setting to "auto", and introduces a new parameter
tls_eecdh_auto_curves with the names of curves that may be negotiated.
* Stored-procedure support for MySQL databases. Contributed by John Fawcett.
See the mysql_table(5) manpage for details.
* Cidr: table support for if/endif and negation (by prepending ! to a pattern),
just like regexp: and pcre: tables. See the cidr_table(5) manpage for details.
* The postmap command and the inline: and texthash: maps now support spaces in
left-hand field of lookup table source text. Use double quotes (") around a
(Only the first 15 lines of the commit message are shown above )
- update to 3.1.4
Changelog:
20161105
Bugfix (introduced: Postfix 1.1): the postsuper command did not count a
successful rename operation after error recovery.
20161204
Bugfix (introduced: Postfix 3.1): cut-and-paste error in the "postfix
tls deploy-server-cert" command, causing the wrong certfile and keyfile
to be used.
Robustness: create a new keyfile when "postfix tls new-server-cert" is
invoked and main.cf specifies a non-existent keyfile.
(Only the first 15 lines of the commit message are shown above )
Do not use post-stage. Use post-install instead.
The only reason to use post-stage is because the port needs to do
"things" at a later time, like some plist manipulation.
While there, fold post-install in do-install targets when they are
defined.
PR: 214780
Submitted by: mat
Exp-run by: antoine
Sponsored by: Absolight
- update to 3.1.3
Changelog:
20160911
Bugfix (introduced: Postfix 3.0): the SMTP daemon did not
reset a previous session's command counts before rejecting
a client that exceeds request or concurrency rates. File:
smtpd/smtpd.c.
20160917
Bugfix (introduced: Postfix 3.0): the unionmap did not
propagate table lookup errors. Based on patch by Roel van
Meer. Files: util/dict_union.c, util/dict_union_test.*.
20160925
Workaround (problem introduced: Postfix 2.11): to avoid
false "not found" errors with MySQL map queries that contain
UTF8-encoded text, specify "option_group = client" in Postfix
MySQL configuration files. This will be the default setting
with Postfix 3.2 and later.
- Update devel/icu to 57.1.
- Clean up the Makefile.
- Follow some upstream recommendations (--with-data-packaging=archive,
--disable-renaming, -DICU_NO_USER_DATA_OVERRIDE).
- Patch makefiles to install static libraries with INSTALL_DATA so they
aren't stripped.
- Patch config/mh-bsd-gcc to sync with config/mh-linux-gcc.
- Fix endianness detection in ICU. The code wanted to use BYTE_ORDER
defined in machine/endian.h, but this isn't visible because ICU is
compiled with _XOPEN_SOURCE. Patch the code to use _BYTE_ORDER instead.
- Compile ICU with C++11 compiler to enable move constructors.
- Patch ICU to fix a problem with atomics in the case of a C++11 compiler
without C++11 header <atomic> (like Clang on FreeBSD 9).
- Bump all ports that depend on it due to library version change.
- Add USES=compiler:c++0x to some ports that pick up -std=c++0x from ICU
pkgconfig files.
- Add USES=compiler:c++11-lib to graphics/libcdr01 because it also needs
a C++11 runtime library now. Add this to all ports that depend on it
so their executables load the right libstdc++.so on FreeBSD 9.
PR: 205120
Exp-run by: antoine
Approved by: portmgr (antoine)
- update to 3.1.2
20160819
Bugfix (introduced: Postfix 3.0): the makedefs script ignored
readme_directory=pathname overrides. Fix by Todd C. Olson.
File: makedefs.
20160821
Bugfix (introduced: Postfix 3.0): the tls_session_ticket_cipher
documentation says aes-256-cbc, but the implementation was
using aes-128-cbc (note that Postfix SMTP server and client
processes have a limited life time).
20160828
Bitrot: fixes for incompatible OpenSSL 1.1.0 API changes.
Viktor Dukhovni. Files: posttls-finger/posttls-finger.c,
tls/tls.h, tls/tls_dane.c, tls/tls_verify.c, tls/tls_server.c,
tls/tls_client.c.
Bump PORTREVISION for the icu revert.
This time not bumping lang/php70, but devel/php70-intl which is the one
really depending on icu.
PR: 205120
With hat: portmgr
Sponsored by: Absolight
- update to 3.1.1
Changelog:
20160228
Documentation: typos in postfix-tls-script(1) manpage.
20160327
Documentation: line wrapping in postconf(1) manpage.
20160310
Bugfix (introduced: Postfix 2.6): the Milter SMFIR_CHGFROM
(replace sender) request lost the sender_bcc_maps address.
Fixed by moving some record keeping to the sender output
function. Files: cleanup/cleanup_envelope.c,
(Only the first 15 lines of the commit message are shown above )
- rework SASL OPTIONS
Dovecot SASL does not need any dependency, from now it will be always build
into postfix
and the default SASL unless Cyrus is also added (there is no conflict between
them)
- add support for FreeBSD 10.3 mailwrapper (install mailer.conf into
LOCALBASE/mail instead /etc/mail)
- add better reload support to rc script
- display correct path in pkg-message
- add support for postfix-sasl slave port
- bump PORTREVISION
Many Thanks to all testers!
PR: 195662
PR: 205162
- rework pkg-install and pkg-message [1]
- install postfix specific mailer.conf.postfix into DATADIR [2]
- use new notation instead PATCH_DIST_STRIP
- bump PORTREVISION
1) detect if the port is installed without TERM, in this case
do not ask the to make postfix the default mailer and respect
the env POSTFIX_DEFAULT_MTA. This helps tools like salt,
ansible, cfengine and puppet during the first package installation.
2) $DATADIR/mailer.conf.postfix can be used by the tools in 1)
MFH: 2016Q1
Improve shebangfix framework
- Support multiple values in *_OLD_CMD, i.e. we can now fix both
"/usr/bin/python" and "/usr/bin/env python" at the same time
- Default *_OLD_CMD values are now always appended, so you don't need to specify
them in individual ports
- Add lua support (depends on USES=lua)
- Add more default values, such as "/usr/bin/env foo" for python, perl, bash,
ruby and lua
- Shebangfix now matches whole words, e.g. we will no longer (erroneously)
replace "/usr/bin/perl5.005" with "${perl_CMD}5.005" (but "/usr/bin/perl -tt" is
still (correctly) replaced with "${perl_CMD} -tt")
Note that *_OLD_CMD items containing spaces must now be quoted (e.g.
perl_OLD_CMD=/bin/perl /usr/bin/perl "/usr/bin/env perl")
Update shebangfix usage according to new rules in many ports:
- Remove *_OLD_CMD for patterns now replaced by default
- Quote custom *_OLD_CMD which contain spaces
Fix shebangfix usage in many ports (irrelevant to infrastructure change):
- Remove redundant SHEBANG_LANG (no need to duplicate default langs)
- Remove redundant *_CMD (such as
python_CMD=${LOCALBASE}/bin/python${PYTHON_VER} when USES=python is present)
- Never use *_OLD_CMD in REINPLACE_CMD matchers, these should always look for
exact string
Approved by: portmgr (bapt)
Differential Revision: D3756
- update to 2.11.7
- use target helpers
ChangeLog:
20150903
Workaround: disable DNSSEC support for AIX 7x and earlier.
The AIX 6/7 resolver(5) API defines RES_USE_DNSSEC without
defining the "ad" bit. Viktor Dukhovni. Files: makedefs,
proto/INSTALL.html, dns/dns.h.
20150923
Bugfix (introduced: 20120531-617): the Postfix SMTP server
used a larger-than-1 VSTREAM buffer to read the HAProxy
connection hand-off information. This broke TLS wrappermode,
as the TLS helo packet would end up in the plaintext VSTREAM
(Only the first 15 lines of the commit message are shown above )
- update to 2.11.6
20150501
Support for Linux 4.*, and some simplification for future
makedefs files. Files: makedefs, util/sys_defs.h.
20150718
Security: opportunistic TLS by default uses "medium" or
stronger ciphers instead of "export" or stronger. See the
RELEASE_NOTES file for how to get the old settings back.
Files: global/mail_params.h, proto/TLS_README.html,
proto/postconf.proto, and files derived from those.
20150719
Security: Postfix TLS support by default no longer uses
(Only the first 15 lines of the commit message are shown above )
VDA: Remove misleading '32bit' in description.
This stemmed from older VDA patches which provided a default patch which only
used 'long' for its data types and a '64bit' patch which used 'long long'.
On 32bit systems 'long' is limited to a 2GB quota while on 64bit systems it will
not be. They later renamed the '64bit' patch to be 'bigquota'. They no longer
provide a 'bigquota' patch due to less demand as most systems are 64bit
today and do not have the small 2GB quota limitation with the 'long' type.
The description of '32bit' was not accurate or useful anymore.
Upstream discussion: http://sourceforge.net/p/vda/mailman/message/24713171/
MASTER_SITES cleanup.
- Replace ${MASTER_SITE_FOO} with FOO.
- Merge MASTER_SITE_SUBDIR into MASTER_SITES when possible. (This means 99.9%
of the time.)
- Remove occurrences of MASTER_SITE_LOCAL when no subdirectory was present and
no hint of what it should be was present.
- Fix some logic.
- And generally, make things more simple and easy to understand.
While there, add magic values to the FESTIVAL, GENTOO, GIMP, GNUPG, QT and
SAMBA macros.
Also, replace some EXTRACT_SUFX occurences with USES=tar:*.
Checked by: make fetch-urlall-list
With hat: portmgr
Sponsored by: Absolight
- update to version 2.11.5
- rename OPTIONS to match default name of most ports
- SASL2 -> SASL
- OPENLDAP -> LDAP
- install main.cf and master.cf with the @sample macro
- rework pkg-install
- fix wrong permission for /var/db/postfix [1]
- sets WANT_OPENLDAP_SASL option for openldap port when
postfix LDAP_SASL option is set [2]
- make usage of new ${opt}_DEPENDS notation
Changelog:
20150324
Bugfix (introduced: Postfix 2.6): sender_dependent_relayhost_maps
ignored the relayhost setting in the case of a DUNNO lookup
(Only the first 15 lines of the commit message are shown above )
- update to 2.11.4
Changes:
20141025
Bugfix (introduced: Postfix 2.11): core dump when
smtp_policy_maps specifies an invalid TLS level. Viktor
Dukhovni. File: smtp/smtp_tls_policy.c.
20150106
Robustness: don't segfault due to excessive recursion after
a faulty configuration runs into the virtual_alias_recursion_limit.
File: global/tok822_tree.c.
20150115
Safety: stop aliasing loops that exponentially increase the
address length with each iteration. Back-ported from Postfix
3.0. File: cleanup/cleanup_map1n.c.
20150117
Cleanup: missing " in \%s\" in postconf(1) fatal error
messages. Iain Hibbert. File: postconf/postconf_master.c.
Approved by: sahil (implicit)
MFH: 2015Q1
- remove dead mirrors from MASTER_SITES
(a good overview can be taken by viewving the
source of http://www.postfix.org/download.html)
- remove MASTER_SITE_SUBDIR, it should be used only for sites defined in
bsd.site.mk
- update conflicts for new postfix-current
- use OPTIONS_SUB
- enable TLS as default [1]
- use USE_OPENSSL instead including Mk/openssl.mk
- use new install instruction
- use new notation for @mode in pkg-plist
- bump PORTREVISON
[1] Users using packages should have the ability to
use TLS from the default package, (this makes the
the postfix-tls port obsolete)
Approved by: sahil (implicit)
MFH: 2015Q1
- install posttls-finger and posttls-finger.man
posttls-finger is handy for many tls related checks
PR: 195293
Submitted by: Darren Pilgrim
Approved by: sahil (implicit)
- sort OPTIONS_DEFINE
- fix build and install for non root users,
(sgid and group for sbin/postdrop and sbin/postqueue was lost if build
as non root and installed with sudo)
- install /var/spool/postfix directories with correct owner/mode
- use $WRKDIR instead of /tmp
Approved by: sahil (implicit)
- update to 2.11.3
- add CPE support
- use PORTDOCS macro
- remove check for OSVERSION >= 800037
- fix OPENLDAP_VER usage
- set PORTSCOUD
- always call set-permissions in post-install to set correct spool/postfix/*
permissions
this is required with pkg to support non interrupted upgrade
Changes:
========
20140619
Bugfix (introduced: 2001): qmqpd null pointer bug when it
logs a lost connection while not in a mail transaction.
Reported by Michal Adamek. File: qmqpd/qmqpd.c.
(Only the first 15 lines of the commit message are shown above )
Berkeley DB cleanup, remove versions 4.0 ... 4.7.
- Mk/bsd.database.mk rewrite, new default to db5.
- db6 is eligible by default only if installed on the system.
- Bump PORTREVISION of all ports that directly depend on BerkeleyDB or
where USE_BDB is found in the port's directory
- Patch a few ports such that they will pick up or work with newer
versions.
- Add UPDATING entry
- Drive-by format fix for pks
- Drop BerkeleyDB option from mail/popular for now, requires more work.
- Exp-run logs linked from the PR below.
- Ports that do not build (IGNORE, BROKEN, etc.) have pro-forma changes
for new Berkeley DB, but are untested.
NOTE: please read UPDATING and the Wiki page before proceeding!
Announcement: http://lists.freebsd.org/pipermail/freebsd-ports-announce/2014-August/000090.html
Wiki reference: https://wiki.freebsd.org/Ports/BerkeleyDBCleanup
PR: 192690
Approved by: portmgr (implicit, PORTREVISION bump on unstaged ports)
mail/libspf2:
- Convert to USES=libtool and bump dependent ports
- Add INSTALL_TARGET=install-strip
(Also some white space fixes in dependent ports)
Approved by: portmgr (implicit, bump unstaged port)
net/openldap24-*:
- Convert to USES=libtool and bump dependent ports
- Avoid USE_AUTOTOOLS
- Don't use PTHREAD_LIBS
- Use MAKE_CMD
databases/glom:
- Drop :keepla
- Add INSTALL_TARGET=install-strip
databases/libgda4* databases/libgda5*:
- Convert to USES=libtool and bump dependent ports
- USES=tar:xz
- Use INSTALL_TARGET=install-strip
- Use @sample
(Only the first 15 lines of the commit message are shown above )
Bump PORTREVISION on all ports with USE_SQLITE=yes or USE_SQLITE=3 that
have not been bumped yet after the latest libsqlite3.so library version
change.
Approved by: portmgr (implicit)
Repo-copy mail/postfix -> mail/postfix29, and update
both ports to the latest version and make a note in
UPDATING. Also:
- Adjust CONFLICTS
- Add LICENSE information
- Canonicalize 'Created by:' Makefile header
- Remove shlib version from LIB_DEPENDS assignment
- Correct LDAP_SASL logic
- Replace tab with a single space after 'WWW:' in pkg-descr
PR: ports/177127
Submitted by: Yasuhiro KIMURA <yasu@utahime.org>
Update to 2.9.5 and revise the PKGINSTALL script to
distinguish between upgrades and fresh installs. Also,
mark BROKEN when users try to build WITH_LDAP_SASL but
WITHOUT_SASL2.
In the rc.d scripts, change assignments to rcvar to use the
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().
In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
Shorten some OPTION descriptions such that they
fit neatly within the dialog(1) box.
PR: ports/162688
Submitted by: Jeremy Chadwick <freebsd@jdc.parodius.com>
Feature safe: yes
