TLS support:

- The Postfix SMTP client enforced mandatory TLS only when talking
  to an ESMTP server; enforcement did not happen if Postfix could
  be forced to send HELO instead of EHLO. This problem also exists
  in Postfix 2.2, and is fixed there with Postfix 2.2 patch 11.

- Workaround for an interoperability problem introduced with Postfix
  2.3.  Some buggy TLS client implementations were unable to deliver
  mail because the Postfix SMTP server didn't send a TLS session
  ID. To disable the workaround specify "smtpd_tls_always_issue_session_ids
  = no"; this allows non-buggy TLS clients to save some space.

Milter support:

- Null pointer bug in the Postfix cleanup server, caused by a
  last-minute change to improve Milter "reject" logging.

- Panic bug in the Postfix SMTP server. With the smtpd_milters
  feature enabled in main.cf, "sendmail -bs" would correctly queue
  mail, but it would panic while it tried to clean up non-existent
  Milter state information.

- The Postfix Milter client created queue files that caused delivery
  agents to loop, when it received requests from Milter applications
  to replace the same message header repeatedly.

- Safety measure. After "postsuper -r", mail is no longer inspected
  by the Milters specified with the non_smtpd_milters parameter.
  This measure prevents a bad interaction with external content
  filters: Milters would receive incorrect SMTP client information,
  and could be tricked into signing or allowing untrusted messages.
  This change does not affect Milter applications that run behind
  an after-queue content filter.

Prereq: "2.3.0"
diff -cr /var/tmp/postfix-2.3.0/src/global/mail_version.h ./src/global/mail_version.h
*** /var/tmp/postfix-2.3.0/src/global/mail_version.h	Tue Jul 11 18:16:21 2006
--- ./src/global/mail_version.h	Mon Jul 24 14:28:13 2006
***************
*** 20,27 ****
    * Patches change both the patchlevel and the release date. Snapshots have no
    * patchlevel; they change the release date only.
    */
! #define MAIL_RELEASE_DATE	"20060711"
! #define MAIL_VERSION_NUMBER	"2.3.0"
  
  #ifdef SNAPSHOT
  # define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
--- 20,27 ----
    * Patches change both the patchlevel and the release date. Snapshots have no
    * patchlevel; they change the release date only.
    */
! #define MAIL_RELEASE_DATE	"20060724"
! #define MAIL_VERSION_NUMBER	"2.3.1"
  
  #ifdef SNAPSHOT
  # define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
diff -cr /var/tmp/postfix-2.3.0/HISTORY ./HISTORY
*** /var/tmp/postfix-2.3.0/HISTORY	Tue Jul 11 20:47:23 2006
--- ./HISTORY	Mon Jul 24 15:29:17 2006
***************
*** 12188,12204 ****
  20060510
  
  	Preliminary TLS_README and postconf(5) changes completed.
  
  	Added smtp_tls_policy_maps and smtp_tls_protocols features
  	to the smtp/lmtp client, changed smtp_tls_cipherlist to
! 	only apply when TLS is mandatory.
  
  20060512
  
  	Destinations that share a common server may have distinct
  	TLS protocol and cipherlist requirements, with mandatory
  	TLS add the protocol and cipherlist values to the TLS session
! 	lookup key.
  
  20060516
  
--- 12188,12205 ----
  20060510
  
  	Preliminary TLS_README and postconf(5) changes completed.
+ 	Victor Duchovni.
  
  	Added smtp_tls_policy_maps and smtp_tls_protocols features
  	to the smtp/lmtp client, changed smtp_tls_cipherlist to
! 	only apply when TLS is mandatory. Victor Duchovni.
  
  20060512
  
  	Destinations that share a common server may have distinct
  	TLS protocol and cipherlist requirements, with mandatory
  	TLS add the protocol and cipherlist values to the TLS session
! 	lookup key. Victor Duchovni.
  
  20060516
  
***************
*** 12228,12241 ****
  
  	The smtp_tls_policy_maps table now implements parent domain
  	matching for destinations that are bare domains (without
! 	enclosin [] or optional :port suffix). This allows one to
  	set TLS policy for a domain and all sub-domains. Victor
  	Duchovni.
  
  20060519
  
  	The same parameter can bind to different variables in
! 	different daemons, ignore the variable name when eliminating
  	duplicates in extract.awk. Victor Duchovni.
  
  20060523
--- 12229,12242 ----
  
  	The smtp_tls_policy_maps table now implements parent domain
  	matching for destinations that are bare domains (without
! 	enclosing [] or optional :port suffix). This allows one to
  	set TLS policy for a domain and all sub-domains. Victor
  	Duchovni.
  
  20060519
  
  	The same parameter can bind to different variables in
! 	different daemons. Ignore the variable name when eliminating
  	duplicates in extract.awk. Victor Duchovni.
  
  20060523
***************
*** 12482,12488 ****
  	after an opportunistic TLS handshake fails. Specify
  	"smtp_sasl_auth_enforce = no" to deliver mail anyway.  File:
  	smtp/smtp_proto.c. See workaround 20060711 for sender-dependent
! 	SASL passwords.
  
  20060709
  
--- 12483,12489 ----
  	after an opportunistic TLS handshake fails. Specify
  	"smtp_sasl_auth_enforce = no" to deliver mail anyway.  File:
  	smtp/smtp_proto.c. See workaround 20060711 for sender-dependent
! 	SASL passwords. This was undone with the 20060719 workaround.
  
  20060709
  
***************
*** 12523,12531 ****
  	after the header label and ":" in an interesting manner.
  	It eats one space (not tab). File: milter/milter8.c.
  
! 	Workaround: if sender-depedendent SASL passwords are enabled,
  	don't defer delivery when a SASL password exists but the
  	server doesn't announce SASL support. File: smtp/smtp_proto.c.
  
  	Cleanup: format of cleanup milter reject messages.  File:
  	cleanup_milter.c.
--- 12524,12533 ----
  	after the header label and ":" in an interesting manner.
  	It eats one space (not tab). File: milter/milter8.c.
  
! 	Workaround: if sender-dependent SASL passwords are enabled,
  	don't defer delivery when a SASL password exists but the
  	server doesn't announce SASL support. File: smtp/smtp_proto.c.
+ 	This was undone with the 20060719 workaround.
  
  	Cleanup: format of cleanup milter reject messages.  File:
  	cleanup_milter.c.
***************
*** 12533,12535 ****
--- 12535,12613 ----
  	Bugfix: file/memory leak if a transfer of multiple milters
  	from smtpd to cleanup broke in the middle.  Found by Coverity.
  	File: milter/milter.c.
+ 
+ 20060716
+ 
+ 	Bugfix: "sendmail -bs" panic caused by a missing
+ 	SMTPD_STATE_ALONE() guard before a milter_abort() call.
+ 	File: smtpd/smtpd.c.
+ 
+ 	Bugfix (bug introduced with Postfix 2.2): the Postfix SMTP
+ 	client enforced Mandatory TLS only when talking to an ESMTP
+ 	server; enforcement did not happen if Postfix could somehow
+ 	be forced to send HELO instead of EHLO.  Victor Duchovni.
+ 	File: src/smtp/smtp_proto.c.
+ 
+ 20060718
+ 
+ 	Bugfix (bug introduced 20060711): null pointer bug when
+ 	rejecting SMTP mail with Milter application.  File:
+ 	cleanup/cleanup_milter.c.
+ 
+ 	Workaround (problem introduced in 200605/200606 TLS update):
+ 	the Postfix SMTP server now issues TLS session IDs even
+ 	when TLS session caching is turned off, otherwise MS Outlook
+ 	fails to deliver mail. There may also be interoperability
+ 	issues with other MTAs that we haven't discovered yet.
+ 	Specify "smtpd_tls_always_issue_session_ids = no" to disable
+ 	the workaround. Victor Duchovni. Files: smtpd/smtpd.c,
+ 	tls/tls_server.c.
+ 
+ 20060719
+ 
+ 	Cleanup: the smtp_sasl_auth_enforce feature is gone. It was
+ 	meant to work around a problem that was introduced with
+ 	plaintext fallback after a failed TLS handshake.  Unfortunately,
+ 	it created more problems than it solved. We now address the
+ 	underlying problem more directly as described next. File:
+ 	smtp/smtp_proto.c.
+ 
+ 	Safety: don't fall back to plaintext delivery after failed
+ 	TLS handshake, when the Postfix SMTP client would have
+ 	attempted to log in with SASL after successful TLS handshake.
+ 	This avoids undesirable behavior regardless of whether the
+ 	server does support SASL over plaintext (unexpected password
+ 	disclosure) and whether the server doesn't support SASL
+ 	over plaintext (insufficient mail relay permission).  Files:
+ 	smtp/smtp_connect.c, smtp/smtp_session.c, smtp/smtp_proto.c.
+ 
+ 20060720
+ 
+ 	Compatibility: replace %% in milter replies by %, and strip
+ 	single (i.e. invalid) % characters. File: milter/milter8.c.
+ 
+ 	Compatibility: $_ macro support for Milter applications.
+ 	Files: smtpd/smtpd.c, smtpd/smtpd_milter.c,
+ 	cleanup/cleanup_state.c, cleanup/cleanup_milter.c.
+ 
+ 20060721
+ 
+ 	Safety: disable Milter processing after "postsuper -r".  If
+ 	the mail has been filtered there is no need to do it again.
+ 	Moreover, when mail has passed through an external content
+ 	filter, we don't have sufficient information to reproduce
+ 	the exact same SMTP events and Sendmail macros that Milters
+ 	received when the mail originally arrived in Postfix.  This
+ 	change does not affect Milter applications that run behind
+ 	an after-queue content filter. File: pickup/pickup.c.
+ 
+ 	Bugfix: Milters received a truncated ORCPT=xxx parameter
+ 	due to destructive parsing of something that didn't have
+ 	to be preserved before Milter support was added to Postfix.
+ 	File: smtpd/smtpd.c.
+ 
+ 20060724
+ 
+ 	Bugfix: when updating the same header multiple times, the
+ 	Postfix Milter client created a queue file that caused
+ 	delivery agents to loop.  File: cleanup/cleanup_milter.c.
diff -cr /var/tmp/postfix-2.3.0/Makefile.in ./Makefile.in
*** /var/tmp/postfix-2.3.0/Makefile.in	Sun Apr 23 20:38:20 2006
--- ./Makefile.in	Fri Jul 21 14:29:49 2006
***************
*** 61,66 ****
--- 61,68 ----
  tidy:	clean
  	rm -f Makefile */Makefile src/*/Makefile
  	cp Makefile.init Makefile
+ 	rm -f README_FILES/RELEASE_NOTES
+ 	ln -s ../RELEASE_NOTES README_FILES
  	rm -f bin/[!CRS]* lib/[!CRS]* include/[!CRS]* libexec/[!CRS]* \
  	    junk */junk */*/junk \
  	    *core */*core */*/*core \
diff -cr /var/tmp/postfix-2.3.0/README_FILES/DB_README ./README_FILES/DB_README
*** /var/tmp/postfix-2.3.0/README_FILES/DB_README	Thu Mar 17 09:14:43 2005
--- ./README_FILES/DB_README	Mon Jul 24 15:07:54 2006
***************
*** 74,80 ****
  Some BSD systems ship with multiple Berkeley DB implementations. Normally,
  Postfix builds with the default DB version that ships with the system.
  
! To build Postfix on BSD systems with a specific DB version, use a variant of
  the following commands:
  
      % make tidy
--- 74,80 ----
  Some BSD systems ship with multiple Berkeley DB implementations. Normally,
  Postfix builds with the default DB version that ships with the system.
  
! To build Postfix on BSD systems with a non-default DB version, use a variant of
  the following commands:
  
      % make tidy
diff -cr /var/tmp/postfix-2.3.0/README_FILES/FILTER_README ./README_FILES/FILTER_README
*** /var/tmp/postfix-2.3.0/README_FILES/FILTER_README	Tue Jul 11 14:02:07 2006
--- ./README_FILES/FILTER_README	Wed Jul 12 09:33:05 2006
***************
*** 344,355 ****
      real client name IP address. See smtp(8) and XFORWARD_README for more
      information.
  
!   * With "-o disable_mime_output_conversion=yes", the scan delivery agent will
!     not convert 8BITMIME mail to quoted-printable form while delivering to the
!     content filter, as that would invalidate domainkeys and other digital
!     signatures. This workaround is needed because some SMTP-based content
!     filters don't announce 8BITMIME support, even though they can handle it
!     just fine.
  
  AAddvvaanncceedd ccoonntteenntt ffiilltteerr:: rruunnnniinngg tthhee ccoonntteenntt ffiilltteerr
  
--- 344,353 ----
      real client name IP address. See smtp(8) and XFORWARD_README for more
      information.
  
!   * The "-o disable_mime_output_conversion=yes" is a workaround that prevents
!     the breaking of domainkeys and other digital signatures. This is needed
!     because some SMTP-based content filters don't announce 8BITMIME support,
!     even though they can handle it just fine.
  
  AAddvvaanncceedd ccoonntteenntt ffiilltteerr:: rruunnnniinngg tthhee ccoonntteenntt ffiilltteerr
  
diff -cr /var/tmp/postfix-2.3.0/README_FILES/LINUX_README ./README_FILES/LINUX_README
*** /var/tmp/postfix-2.3.0/README_FILES/LINUX_README	Sun Feb 27 16:13:25 2005
--- ./README_FILES/LINUX_README	Sun Jul 23 10:11:29 2006
***************
*** 5,14 ****
  BBeerrkkeelleeyy DDBB iissssuueess
  
  Warning: if you can't compile Postfix because the file "db.h" isn't found, then
! you MUST install the Berkeley DB development package (package name: db???-
! devel-???) that comes with your Linux system. Only that package contains the
! files that correspond to the Berkeley DB version that is used by the system
! library routines.
  
  DO NOT download some Berkeley DB version from the network. Every Postfix
  program will dump core when it is built with a different Berkeley DB version
--- 5,19 ----
  BBeerrkkeelleeyy DDBB iissssuueess
  
  Warning: if you can't compile Postfix because the file "db.h" isn't found, then
! you MUST install the Berkeley DB development package (name: db???-devel-???)
! that matches your system library. You can find out what is installed with the
! rpm command. For example:
! 
!     $ rrppmm --qqff //uussrr//lliibb//lliibbddbb..ssoo
!     db4-4.3.29-2
! 
! This means that you need to install db4-devel-4.3.29-2 (on some systems,
! specify /lib/libdb.so in the rpm query).
  
  DO NOT download some Berkeley DB version from the network. Every Postfix
  program will dump core when it is built with a different Berkeley DB version
diff -cr /var/tmp/postfix-2.3.0/README_FILES/MILTER_README ./README_FILES/MILTER_README
*** /var/tmp/postfix-2.3.0/README_FILES/MILTER_README	Tue Jul 11 17:22:27 2006
--- ./README_FILES/MILTER_README	Fri Jul 21 18:37:02 2006
***************
*** 104,110 ****
      Sendmail source code instead:
  
          $ ggzzccaatt sseennddmmaaiill--xx..yy..zz..ttaarr..ggzz || ttaarr xxff --
!         $ ccdd sseennddmmaaiill--xx..yy..zz
          $ mmaakkee
          [...lots of output omitted...]
  
--- 104,110 ----
      Sendmail source code instead:
  
          $ ggzzccaatt sseennddmmaaiill--xx..yy..zz..ttaarr..ggzz || ttaarr xxff --
!         $ ccdd sseennddmmaaiill--xx..yy..zz//lliibbmmiilltteerr
          $ mmaakkee
          [...lots of output omitted...]
  
***************
*** 316,321 ****
--- 316,324 ----
      |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
      |j                   |Always                   |value of myhostname       |
      |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
+     |_                   |Always                   |The validated client name |
+     |                    |                         |and address               |
+     |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
      |{auth_authen}       |MAIL, DATA, EOM          |SASL login name           |
      |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
      |{auth_author}       |MAIL, DATA, EOM          |SASL sender               |
***************
*** 382,390 ****
  WWoorrkkaarroouunnddss
  
  Content filters may break domain key etc. signatures. If you use an SMTP-based
! filter as described in FILTER_README, then you should add a line to master.cf
! with "disable_mime_output_conversion = yes", as described in the advanced
! content filter example.
  
  Sendmail Milter applications were originally developed for the Sendmail version
  8 MTA, which has a different architecture than Postfix. The result is that some
--- 385,393 ----
  WWoorrkkaarroouunnddss
  
  Content filters may break domain key etc. signatures. If you use an SMTP-based
! content filter, then you should add a line to master.cf with "-
! o disable_mime_output_conversion=yes" (note: no spaces around the "="), as
! described in the advanced content filter example.
  
  Sendmail Milter applications were originally developed for the Sendmail version
  8 MTA, which has a different architecture than Postfix. The result is that some
diff -cr /var/tmp/postfix-2.3.0/README_FILES/SASL_README ./README_FILES/SASL_README
*** /var/tmp/postfix-2.3.0/README_FILES/SASL_README	Fri Jun 30 20:49:40 2006
--- ./README_FILES/SASL_README	Tue Jul 18 20:29:13 2006
***************
*** 71,83 ****
  To generate the necessary Makefiles, execute the following in the Postfix top-
  level directory:
  
!     % make makefiles CCARGS='-DUSE_SASL_AUTH -DDEF_SASL_SERVER=\"dovecot\"'
  
  After this, proceed with "make" as described in the INSTALL document.
  
  Notes:
  
!   * The "-DDEF_SASL_SERVER" stuff is not necessary; it just makes Postfix
      configuration a little more convenient because you don't have to specify
      the SASL plug-in type in the Postfix main.cf file.
  
--- 71,84 ----
  To generate the necessary Makefiles, execute the following in the Postfix top-
  level directory:
  
!     % make makefiles CCARGS='-DUSE_SASL_AUTH -
!     DDEF_SASL_SERVER_TYPE=\"dovecot\"'
  
  After this, proceed with "make" as described in the INSTALL document.
  
  Notes:
  
!   * The "-DDEF_SASL_SERVER_TYPE" stuff is not necessary; it just makes Postfix
      configuration a little more convenient because you don't have to specify
      the SASL plug-in type in the Postfix main.cf file.
  
diff -cr /var/tmp/postfix-2.3.0/README_FILES/TLS_README ./README_FILES/TLS_README
*** /var/tmp/postfix-2.3.0/README_FILES/TLS_README	Tue Jul 11 20:17:37 2006
--- ./README_FILES/TLS_README	Mon Jul 24 15:13:45 2006
***************
*** 323,330 ****
  
  It is strictly discouraged to use this mode from main.cf. If you want to
  support this service, enable a special port in master.cf and specify "-
! o smtpd_tls_wrappermode = yes" as an smtpd(8) command line option. Port 465
! (smtps) was once chosen for this feature.
  
  Example:
  
--- 323,330 ----
  
  It is strictly discouraged to use this mode from main.cf. If you want to
  support this service, enable a special port in master.cf and specify "-
! o smtpd_tls_wrappermode=yes" (note: no space around the "=") as an smtpd(8)
! command line option. Port 465 (smtps) was once chosen for this feature.
  
  Example:
  
***************
*** 426,431 ****
--- 426,442 ----
      /etc/postfix/main.cf:
          smtpd_tls_session_cache_timeout = 3600s
  
+ When the Postfix SMTP server does not save TLS sessions to an external cache
+ database, client-side session caching is unlikely to be useful. To prevent such
+ wastage, the Postfix SMTP server can be configured to not issue TLS session
+ ids. By default the Postfix SMTP server always issues TLS session ids. This
+ works around known interoperability issues with some MUAs, and prevents
+ possible interoperability issues with other MTAs.
+ 
+ Example:
+ 
+         smtpd_tls_always_issue_session_ids = no
+ 
  SSeerrvveerr aacccceessss ccoonnttrrooll
  
  Postfix TLS support introduces three additional features for Postfix SMTP
***************
*** 1421,1435 ****
  no guarantee that Postfix is connected to the right server. To avoid this
  loophole, take all of the following steps:
  
!  1. Use a dedicated transport for all secure-channel deliveries.
  
   2. Eliminate MX lookups. Specify local transport(5) table entries for
!     sensitive domains with explicit smtp:[mailhost] or smtp:[mailhost]:port
!     destinations (you can assure security of this table unlike DNS); in the
!     smtp_tls_per_site table, specify the value "MUST" for the key [mailhost] or
!     smtp:[mailhost]:port. This prevents false hostname information in DNS MX
!     records from changing Postfix's notion of the server hostname that is used
!     for TLS policy lookup and server certificate verification.
  
   3. Disallow CNAME hostname overrides. In main.cf, specify
      "smtp_cname_overrides_servername = no". This prevents false hostname
--- 1432,1449 ----
  no guarantee that Postfix is connected to the right server. To avoid this
  loophole, take all of the following steps:
  
!  1. Use a dedicated message delivery transport (for example, "securetls") as
!     illustrated below.
  
   2. Eliminate MX lookups. Specify local transport(5) table entries for
!     sensitive domains with explicit securetls:[mailhost] or securetls:
!     [mailhost]:port destinations (you can assure security of this table unlike
!     DNS). This prevents false hostname information in DNS MX records from
!     changing Postfix's notion of the server hostname that is used for TLS
!     policy lookup and server certificate verification. The "securetls"
!     transport is configured to enforce TLS with peername verification, and to
!     disable the SMTP connection cache which could interfere with enforcement of
!     smtp_tls_per_site policies.
  
   3. Disallow CNAME hostname overrides. In main.cf, specify
      "smtp_cname_overrides_servername = no". This prevents false hostname
***************
*** 1459,1466 ****
  
      /etc/postfix/master.cf:
          securetls unix  -       -       n       -       100     smtp
-             -o smtp_connection_cache_on_demand=no
-             -o smtp_connection_cache_destinations=
              -o smtp_enforce_tls=yes
              -o smtp_tls_enforce_peername=yes
  
--- 1473,1478 ----
diff -cr /var/tmp/postfix-2.3.0/conf/postfix-files ./conf/postfix-files
*** /var/tmp/postfix-2.3.0/conf/postfix-files	Fri Jun 23 02:21:55 2006
--- ./conf/postfix-files	Wed Jul 19 21:01:07 2006
***************
*** 353,358 ****
--- 353,359 ----
  $html_directory/postconf.5.html:f:root:-:644
  $html_directory/postdrop.1.html:f:root:-:644
  $html_directory/postfix-logo.jpg:f:root:-:644
+ $html_directory/postfix-manuals.html:f:root:-:644
  $html_directory/postfix.1.html:f:root:-:644
  $html_directory/postkick.1.html:f:root:-:644
  $html_directory/postlock.1.html:f:root:-:644
diff -cr /var/tmp/postfix-2.3.0/html/DB_README.html ./html/DB_README.html
*** /var/tmp/postfix-2.3.0/html/DB_README.html	Thu Mar 17 09:14:43 2005
--- ./html/DB_README.html	Mon Jul 24 15:07:54 2006
***************
*** 112,118 ****
  Normally, Postfix builds with the default DB version that ships
  with the system. </p>
  
! <p> To build Postfix on BSD systems with a specific DB version,
  use a variant of the following commands: </p>
  
  <blockquote>
--- 112,118 ----
  Normally, Postfix builds with the default DB version that ships
  with the system. </p>
  
! <p> To build Postfix on BSD systems with a non-default DB version,
  use a variant of the following commands: </p>
  
  <blockquote>
diff -cr /var/tmp/postfix-2.3.0/html/FILTER_README.html ./html/FILTER_README.html
*** /var/tmp/postfix-2.3.0/html/FILTER_README.html	Tue Jul 11 14:02:07 2006
--- ./html/FILTER_README.html	Wed Jul 12 09:33:04 2006
***************
*** 634,645 ****
  the real client name IP address. See <a href="smtp.8.html">smtp(8)</a> and <a href="XFORWARD_README.html">XFORWARD_README</a>
  for more information. </p>
  
! <li> <p> With "-o <a href="postconf.5.html#disable_mime_output_conversion">disable_mime_output_conversion</a>=yes", the scan
! delivery agent will not convert 8BITMIME mail to quoted-printable
! form while delivering to the content filter, as that would invalidate
! domainkeys and other digital signatures.  This workaround is needed
! because some SMTP-based content filters don't announce 8BITMIME
! support, even though they can handle it just fine.  </p>
  
  </ul>
  
--- 634,643 ----
  the real client name IP address. See <a href="smtp.8.html">smtp(8)</a> and <a href="XFORWARD_README.html">XFORWARD_README</a>
  for more information. </p>
  
! <li> <p> The "-o <a href="postconf.5.html#disable_mime_output_conversion">disable_mime_output_conversion</a>=yes" is a workaround
! that prevents the breaking of domainkeys and other digital signatures.
! This is needed because some SMTP-based content filters don't announce
! 8BITMIME support, even though they can handle it just fine.  </p>
  
  </ul>
  
diff -cr /var/tmp/postfix-2.3.0/html/LINUX_README.html ./html/LINUX_README.html
*** /var/tmp/postfix-2.3.0/html/LINUX_README.html	Sun Feb 27 16:13:23 2005
--- ./html/LINUX_README.html	Sun Jul 23 10:11:29 2006
***************
*** 21,30 ****
  
  <p> Warning: if you can't compile Postfix because the file "db.h"
  isn't found, then you MUST install the Berkeley DB development
! package (package name: db???-devel-???) that comes with your Linux
! system. Only that package contains the files that correspond to the
! Berkeley DB version that is used by the system library routines.
  </p>
  
  <p> DO NOT download some Berkeley DB version from the network.
  Every Postfix program will dump core when it is built with a different
--- 21,39 ----
  
  <p> Warning: if you can't compile Postfix because the file "db.h"
  isn't found, then you MUST install the Berkeley DB development
! package (name: db???-devel-???) that matches your system library.
! You can find out what is installed with the rpm command. For example:
  </p>
+ 
+ <blockquote>
+ <pre>
+ $ <b>rpm -qf /usr/lib/libdb.so</b>
+ db4-4.3.29-2
+ </pre>
+ </blockquote>
+ 
+ <p> This means that you need to install db4-devel-4.3.29-2 (on
+ some systems, specify <tt>/lib/libdb.so</tt> in the rpm query). </p>
  
  <p> DO NOT download some Berkeley DB version from the network.
  Every Postfix program will dump core when it is built with a different
diff -cr /var/tmp/postfix-2.3.0/html/MILTER_README.html ./html/MILTER_README.html
*** /var/tmp/postfix-2.3.0/html/MILTER_README.html	Tue Jul 11 17:22:27 2006
--- ./html/MILTER_README.html	Fri Jul 21 18:37:01 2006
***************
*** 228,234 ****
  <blockquote>
  <pre>
  $ <b>gzcat sendmail-<i>x.y.z</i>.tar.gz | tar xf -</b>
! $ <b>cd sendmail-<i>x.y.z</i></b>
  $ <b>make</b>
  [...<i>lots of output omitted</i>...]
  </pre>
--- 228,234 ----
  <blockquote>
  <pre>
  $ <b>gzcat sendmail-<i>x.y.z</i>.tar.gz | tar xf -</b>
! $ <b>cd sendmail-<i>x.y.z</i>/libmilter</b>
  $ <b>make</b>
  [...<i>lots of output omitted</i>...]
  </pre>
***************
*** 521,526 ****
--- 521,529 ----
  <tr> <td> j </td> <td> Always </td> <td> value of <a href="postconf.5.html#myhostname">myhostname</a> </td>
  </tr>
  
+ <tr> <td> _ </td> <td> Always </td> <td> The validated client name
+ and address </td> </tr>
+ 
  <tr> <td> {auth_authen} </td> <td> MAIL, DATA, EOM </td> <td> SASL
  login name </td> </tr>
  
***************
*** 613,621 ****
  <h2><a name="workarounds">Workarounds</a></h2>
  
  <p> Content filters may break domain key etc. signatures. If you
! use an SMTP-based filter as described in <a href="FILTER_README.html">FILTER_README</a>, then you
! should add a line to <a href="master.5.html">master.cf</a> with "<a href="postconf.5.html#disable_mime_output_conversion">disable_mime_output_conversion</a>
! = yes", as described in the <a
  href="FILTER_README.html#advanced_filter">advanced content filter</a>
  example. </p>
  
--- 616,624 ----
  <h2><a name="workarounds">Workarounds</a></h2>
  
  <p> Content filters may break domain key etc. signatures. If you
! use an SMTP-based content filter, then you should add a line to
! <a href="master.5.html">master.cf</a> with "-o <a href="postconf.5.html#disable_mime_output_conversion">disable_mime_output_conversion</a>=yes" (note: no
! spaces around the "="), as described in the <a
  href="FILTER_README.html#advanced_filter">advanced content filter</a>
  example. </p>
  
diff -cr /var/tmp/postfix-2.3.0/html/SASL_README.html ./html/SASL_README.html
*** /var/tmp/postfix-2.3.0/html/SASL_README.html	Fri Jun 30 20:49:40 2006
--- ./html/SASL_README.html	Tue Jul 18 20:29:13 2006
***************
*** 127,133 ****
  
  <blockquote>
  <pre>
! % make makefiles CCARGS='-DUSE_SASL_AUTH -DDEF_SASL_SERVER=\"dovecot\"'
  </pre>
  </blockquote>
  
--- 127,133 ----
  
  <blockquote>
  <pre>
! % make makefiles CCARGS='-DUSE_SASL_AUTH -DDEF_SASL_SERVER_TYPE=\"dovecot\"'
  </pre>
  </blockquote>
  
***************
*** 138,144 ****
  
  <ul>
  
! <li> <p> The "-DDEF_SASL_SERVER" stuff is not necessary; it just
  makes Postfix configuration a little more convenient because you
  don't have to specify the SASL plug-in type in the Postfix <a href="postconf.5.html">main.cf</a>
  file.  </p>
--- 138,144 ----
  
  <ul>
  
! <li> <p> The "-DDEF_SASL_SERVER_TYPE" stuff is not necessary; it just
  makes Postfix configuration a little more convenient because you
  don't have to specify the SASL plug-in type in the Postfix <a href="postconf.5.html">main.cf</a>
  file.  </p>
diff -cr /var/tmp/postfix-2.3.0/html/TLS_README.html ./html/TLS_README.html
*** /var/tmp/postfix-2.3.0/html/TLS_README.html	Tue Jul 11 20:17:35 2006
--- ./html/TLS_README.html	Mon Jul 24 15:13:45 2006
***************
*** 490,497 ****
  
  <p> It is strictly discouraged to use this mode from <a href="postconf.5.html">main.cf</a>. If
  you want to support this service, enable a special port in <a href="master.5.html">master.cf</a>
! and specify "-o <a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a> = yes" as an <a href="smtpd.8.html">smtpd(8)</a> command
! line option.  Port 465 (smtps) was once chosen for this feature.
  </p>
  
  <p> Example: </p>
--- 490,498 ----
  
  <p> It is strictly discouraged to use this mode from <a href="postconf.5.html">main.cf</a>. If
  you want to support this service, enable a special port in <a href="master.5.html">master.cf</a>
! and specify "-o <a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a>=yes" (note: no space around
! the "=") as an <a href="smtpd.8.html">smtpd(8)</a> command line option.  Port 465 (smtps) was
! once chosen for this feature.
  </p>
  
  <p> Example: </p>
***************
*** 631,636 ****
--- 632,653 ----
  </pre>
  </blockquote>
  
+ <p> When the Postfix SMTP server does not save TLS sessions to an
+ external cache database, client-side session caching is unlikely
+ to be useful.  To prevent such wastage, the Postfix SMTP server can
+ be configured to not issue TLS session ids. By default the Postfix
+ SMTP server always issues TLS session ids. This works around known
+ interoperability issues with some MUAs, and prevents possible
+ interoperability issues with other MTAs. </p>
+ 
+ <p> Example: </p>
+ 
+ <blockquote>
+ <pre>
+     <a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> = no
+ </pre>
+ </blockquote>
+ 
  <h3><a name="server_access">Server access control</a> </h3>
  
  <p> Postfix TLS support introduces three additional features for
***************
*** 1822,1831 ****
  <dl>
  
  <dt> remote SMTP server hostname </dt> <dd> This is simply the DNS
! name of the server that the Postfix SMTP client connects to; this name
! may be obtained from other DNS lookups, such as MX lookups or CNAME
! lookups. Use of the hostname lookup key is discouraged; always use the
! next-hop destination instead. </dd>
  
  <dt> next-hop destination </dt> <dd> This is normally the domain portion
  of the recipient address, but it may be overridden by information from
--- 1839,1848 ----
  <dl>
  
  <dt> remote SMTP server hostname </dt> <dd> This is simply the DNS
! name of the server that the Postfix SMTP client connects to; this
! name may be obtained from other DNS lookups, such as MX lookups or
! CNAME lookups. Use of the hostname lookup key is discouraged; always
! use the next-hop destination instead. </dd>
  
  <dt> next-hop destination </dt> <dd> This is normally the domain portion
  of the recipient address, but it may be overridden by information from
***************
*** 1924,1940 ****
  
  <ol>
  
! <li> <p> Use a dedicated transport for all secure-channel deliveries. </p>
  
  <li> <p> Eliminate MX lookups. Specify local <a href="transport.5.html">transport(5)</a> table
! entries for sensitive domains with explicit <a href="smtp.8.html">smtp</a>:[<i>mailhost</i>]
! or <a href="smtp.8.html">smtp</a>:[<i>mailhost</i>]:<i>port</i> destinations (you can assure
! security of this table unlike DNS); in the <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a>
! table, specify the value "MUST" for the key [<i>mailhost</i>] or
! <a href="smtp.8.html">smtp</a>:[<i>mailhost</i>]:<i>port</i>. This prevents false hostname
! information in DNS MX records from changing Postfix's notion of the
! server hostname that is used for TLS policy lookup and server certificate
! verification. </p>
  
  <li> <p> Disallow CNAME hostname overrides. In <a href="postconf.5.html">main.cf</a>, specify
  "<a href="postconf.5.html#smtp_cname_overrides_servername">smtp_cname_overrides_servername</a> = no". This prevents false hostname
--- 1941,1959 ----
  
  <ol>
  
! <li> <p> Use a dedicated message delivery transport (for example,
! "securetls") as illustrated below. </p>
  
  <li> <p> Eliminate MX lookups. Specify local <a href="transport.5.html">transport(5)</a> table
! entries for sensitive domains with explicit securetls:[<i>mailhost</i>]
! or securetls:[<i>mailhost</i>]:<i>port</i> destinations (you can
! assure security of this table unlike DNS). This prevents false
! hostname information in DNS MX records from changing Postfix's
! notion of the server hostname that is used for TLS policy lookup
! and server certificate verification. The "securetls" transport is
! configured to enforce TLS with peername verification, and to disable
! the SMTP connection cache which could interfere with enforcement
! of <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> policies. </p>
  
  <li> <p> Disallow CNAME hostname overrides. In <a href="postconf.5.html">main.cf</a>, specify
  "<a href="postconf.5.html#smtp_cname_overrides_servername">smtp_cname_overrides_servername</a> = no". This prevents false hostname
***************
*** 1971,1978 ****
  
  /etc/postfix/<a href="master.5.html">master.cf</a>:
      securetls unix  -       -       n       -       100     smtp
-         -o <a href="postconf.5.html#smtp_connection_cache_on_demand">smtp_connection_cache_on_demand</a>=no
-         -o <a href="postconf.5.html#smtp_connection_cache_destinations">smtp_connection_cache_destinations</a>=
          -o <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>=yes
          -o <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>=yes
  </pre>
--- 1990,1995 ----
diff -cr /var/tmp/postfix-2.3.0/html/lmtp.8.html ./html/lmtp.8.html
*** /var/tmp/postfix-2.3.0/html/lmtp.8.html	Tue Jul 11 20:19:22 2006
--- ./html/lmtp.8.html	Wed Jul 19 17:44:23 2006
***************
*** 293,305 ****
  
         Available in Postfix version 2.3 and later:
  
-        <b><a href="postconf.5.html#smtp_sasl_auth_enforce">smtp_sasl_auth_enforce</a> (yes)</b>
-               If sender-dependent SASL passwords are turned  off,
-               defer  mail  delivery  when an SMTP server does not
-               support SASL authentication, while  <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_pass</a>-
-               <a href="postconf.5.html#smtp_sasl_password_maps">word_maps</a>  contains SASL login/password information
-               for that server.
- 
         <b><a href="postconf.5.html#smtp_sender_dependent_authentication">smtp_sender_dependent_authentication</a> (no)</b>
                Enable sender-dependent authentication in the Post-
                fix  SMTP  client; this is available only with SASL
--- 293,298 ----
***************
*** 386,391 ****
--- 379,394 ----
                Log the hostname  of  a  remote  SMTP  server  that
                offers  STARTTLS,  when  TLS is not already enabled
                for that server.
+ 
+        <b><a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> (empty)</b>
+               Optional lookup tables with the Postfix SMTP client
+               TLS security policy by next-hop destination; when a
+               non-empty value is specified,  this  overrides  the
+               obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter.
+ 
+        <b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (SSLv3, TLSv1)</b>
+               List  of TLS protocols that the Postfix SMTP client
+               will use with mandatory TLS encryption.
  
         <b><a href="postconf.5.html#smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a> (5)</b>
                The verification depth for remote SMTP server  cer-
diff -cr /var/tmp/postfix-2.3.0/html/postconf.5.html ./html/postconf.5.html
*** /var/tmp/postfix-2.3.0/html/postconf.5.html	Tue Jul 11 20:17:36 2006
--- ./html/postconf.5.html	Sat Jul 22 20:58:17 2006
***************
*** 3558,3574 ****
  
  </DD>
  
- <DT><b><a name="lmtp_sasl_auth_enforce">lmtp_sasl_auth_enforce</a>
- (default: yes)</b></DT><DD>
- 
- <p> The LMTP-specific version of the <a href="postconf.5.html#smtp_sasl_auth_enforce">smtp_sasl_auth_enforce</a>
- configuration parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.3 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="lmtp_sasl_mechanism_filter">lmtp_sasl_mechanism_filter</a>
  (default: empty)</b></DT><DD>
  
--- 3558,3563 ----
***************
*** 7592,7610 ****
  
  </DD>
  
- <DT><b><a name="smtp_sasl_auth_enforce">smtp_sasl_auth_enforce</a>
- (default: yes)</b></DT><DD>
- 
- <p> If sender-dependent SASL passwords are turned off, defer mail
- delivery when an SMTP server does not support SASL authentication,
- while <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a> contains SASL login/password information
- for that server.  </p>
- 
- <p> This feature is available in Postfix 2.3 and later. </p>
- 
- 
- </DD>
- 
  <DT><b><a name="smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a>
  (default: empty)</b></DT><DD>
  
--- 7581,7586 ----
***************
*** 9819,9825 ****
  <DT><b><a name="smtpd_peername_lookup">smtpd_peername_lookup</a>
  (default: yes)</b></DT><DD>
  
! <p> Attempt to look up the Postfix SMTP client hostname, and verify that
  the name matches the client IP address. A client name is set to
  "unknown" when it cannot be looked up or verified, or when name
  lookup is disabled.  Turning off name lookup reduces delays due to
--- 9795,9801 ----
  <DT><b><a name="smtpd_peername_lookup">smtpd_peername_lookup</a>
  (default: yes)</b></DT><DD>
  
! <p> Attempt to look up the remote SMTP client hostname, and verify that
  the name matches the client IP address. A client name is set to
  "unknown" when it cannot be looked up or verified, or when name
  lookup is disabled.  Turning off name lookup reduces delays due to
***************
*** 10778,10783 ****
--- 10754,10789 ----
  </pre>
  
  <p> This feature is available in Postfix 2.2 and later.  </p>
+ 
+ 
+ </DD>
+ 
+ <DT><b><a name="smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a>
+ (default: yes)</b></DT><DD>
+ 
+ <p> Force the Postfix SMTP server to issue a TLS session id, even
+ when TLS session caching is turned off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>
+ is empty). This behavior is compatible with Postfix &lt; 2.3. </p>
+ 
+ <p> With Postfix 2.3 and later the Postfix SMTP server can disable
+ session id generation when TLS session caching is turned off. This
+ keeps clients from caching sessions that almost certainly cannot
+ be re-used.  </p>
+ 
+ <p> By default, the Postfix SMTP server always generates TLS session
+ ids. This works around a known defect in mail client applications
+ such as MS Outlook, and may also prevent interoperability issues
+ with other MTAs. </p>
+ 
+ <p> Example: </p>
+ 
+ <blockquote>
+ <pre>
+     <a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> = no
+ </pre>
+ </blockquote>
+ 
+ <p> This feature is available in Postfix 2.3 and later. </p>
  
  
  </DD>
diff -cr /var/tmp/postfix-2.3.0/html/postfix-manuals.html ./html/postfix-manuals.html
*** /var/tmp/postfix-2.3.0/html/postfix-manuals.html	Sat Dec  3 18:51:44 2005
--- ./html/postfix-manuals.html	Wed Jul 19 12:32:21 2006
***************
*** 113,121 ****
  
  <li> <a href="bounce.5.html">bounce(5)</a>, Postfix bounce message templates 
  
! <li> <a href="master.5.html">master(5)</a>, Postfix master.cf file syntax 
  
! <li> <a href="postconf.5.html">postconf(5)</a>, Postfix main.cf file syntax 
  
  </ul>
  
--- 113,121 ----
  
  <li> <a href="bounce.5.html">bounce(5)</a>, Postfix bounce message templates 
  
! <li> <a href="master.5.html">master(5)</a>, Postfix <a href="master.5.html">master.cf</a> file syntax 
  
! <li> <a href="postconf.5.html">postconf(5)</a>, Postfix <a href="postconf.5.html">main.cf</a> file syntax 
  
  </ul>
  
diff -cr /var/tmp/postfix-2.3.0/html/postfix.1.html ./html/postfix.1.html
*** /var/tmp/postfix-2.3.0/html/postfix.1.html	Sat Dec  3 18:51:44 2005
--- ./html/postfix.1.html	Wed Jul 19 12:32:21 2006
***************
*** 62,68 ****
                <b>postfix-files</b> file.
  
                Specify <i>name</i>=<i>value</i> to override and update  specific
!               main.cf  configuration  parameters.  Use  this, for
                example, to change the <b><a href="postconf.5.html#mail_owner">mail_owner</a></b>  or  <b><a href="postconf.5.html#setgid_group">setgid_group</a></b>
                setting for an already installed Postfix system.
  
--- 62,68 ----
                <b>postfix-files</b> file.
  
                Specify <i>name</i>=<i>value</i> to override and update  specific
!               <a href="postconf.5.html">main.cf</a>  configuration  parameters.  Use  this, for
                example, to change the <b><a href="postconf.5.html#mail_owner">mail_owner</a></b>  or  <b><a href="postconf.5.html#setgid_group">setgid_group</a></b>
                setting for an already installed Postfix system.
  
***************
*** 71,83 ****
                <b>fix/post-install set-permissions</b>".
  
         <b>upgrade-configuration [</b><i>name</i>=<i>value ...</i><b>]</b>
!               Update  the <b>main.cf</b> and <b>master.cf</b> files with infor-
                mation that Postfix needs in order to run:  add  or
                update  services,  and  add or update configuration
                parameter settings.
  
                Specify <i>name</i>=<i>value</i> to override and update  specific
!               main.cf configuration parameters.
  
                This feature is available in Postfix 2.1 and later.
                With  Postfix  2.0  and  earlier,  use  "<b>/etc/post-</b>
--- 71,83 ----
                <b>fix/post-install set-permissions</b>".
  
         <b>upgrade-configuration [</b><i>name</i>=<i>value ...</i><b>]</b>
!               Update  the <a href="postconf.5.html"><b>main.cf</b></a> and <a href="master.5.html"><b>master.cf</b></a> files with infor-
                mation that Postfix needs in order to run:  add  or
                update  services,  and  add or update configuration
                parameter settings.
  
                Specify <i>name</i>=<i>value</i> to override and update  specific
!               <a href="postconf.5.html">main.cf</a> configuration parameters.
  
                This feature is available in Postfix 2.1 and later.
                With  Postfix  2.0  and  earlier,  use  "<b>/etc/post-</b>
***************
*** 86,92 ****
         The following options are implemented:
  
         <b>-c</b> <i>config</i><b>_</b><i>dir</i>
!               Read  the <b>main.cf</b> and <b>master.cf</b> configuration files
                in the named directory instead of the default  con-
                figuration  directory.   Use  this  to  distinguish
                between multiple  Postfix  instances  on  the  same
--- 86,92 ----
         The following options are implemented:
  
         <b>-c</b> <i>config</i><b>_</b><i>dir</i>
!               Read  the <a href="postconf.5.html"><b>main.cf</b></a> and <a href="master.5.html"><b>master.cf</b></a> configuration files
                in the named directory instead of the default  con-
                figuration  directory.   Use  this  to  distinguish
                between multiple  Postfix  instances  on  the  same
***************
*** 118,124 ****
                present.
  
  <b>CONFIGURATION PARAMETERS</b>
!        The   following   <b>main.cf</b>   configuration  parameters  are
         exported as environment variables with the same names:
  
         <b><a href="postconf.5.html#command_directory">command_directory</a> (see 'postconf -d' output)</b>
--- 118,124 ----
                present.
  
  <b>CONFIGURATION PARAMETERS</b>
!        The   following   <a href="postconf.5.html"><b>main.cf</b></a>   configuration  parameters  are
         exported as environment variables with the same names:
  
         <b><a href="postconf.5.html#command_directory">command_directory</a> (see 'postconf -d' output)</b>
***************
*** 130,137 ****
                daemon programs.
  
         <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
!               The default location of  the  Postfix  main.cf  and
!               master.cf configuration files.
  
         <b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
                The  location of the Postfix top-level queue direc-
--- 130,137 ----
                daemon programs.
  
         <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
!               The default location of  the  Postfix  <a href="postconf.5.html">main.cf</a>  and
!               <a href="master.5.html">master.cf</a> configuration files.
  
         <b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
                The  location of the Postfix top-level queue direc-
***************
*** 173,180 ****
         Other configuration parameters:
  
         <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
!               The  default  location  of  the Postfix main.cf and
!               master.cf configuration files.
  
         <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
                The list of environment parameters that  a  Postfix
--- 173,180 ----
         Other configuration parameters:
  
         <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
!               The  default  location  of  the Postfix <a href="postconf.5.html">main.cf</a> and
!               <a href="master.5.html">master.cf</a> configuration files.
  
         <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
                The list of environment parameters that  a  Postfix
***************
*** 190,197 ****
                becomes, for example, "postfix/smtpd".
  
  <b>FILES</b>
!        /etc/postfix/main.cf, Postfix configuration parameters
!        /etc/postfix/master.cf, Postfix daemon processes
         /etc/postfix/postfix-files, file/directory permissions
         /etc/postfix/postfix-script, administrative commands
         /etc/postfix/post-install, post-installation configuration
--- 190,197 ----
                becomes, for example, "postfix/smtpd".
  
  <b>FILES</b>
!        /etc/postfix/<a href="postconf.5.html">main.cf</a>, Postfix configuration parameters
!        /etc/postfix/<a href="master.5.html">master.cf</a>, Postfix daemon processes
         /etc/postfix/postfix-files, file/directory permissions
         /etc/postfix/postfix-script, administrative commands
         /etc/postfix/post-install, post-installation configuration
***************
*** 214,221 ****
  
         Postfix configuration:
         <a href="bounce.5.html">bounce(5)</a>, Postfix bounce message templates
!        <a href="master.5.html">master(5)</a>, Postfix master.cf file syntax
!        <a href="postconf.5.html">postconf(5)</a>, Postfix main.cf file syntax
  
         Table-driven mechanisms:
         <a href="access.5.html">access(5)</a>, Postfix SMTP access control table
--- 214,221 ----
  
         Postfix configuration:
         <a href="bounce.5.html">bounce(5)</a>, Postfix bounce message templates
!        <a href="master.5.html">master(5)</a>, Postfix <a href="master.5.html">master.cf</a> file syntax
!        <a href="postconf.5.html">postconf(5)</a>, Postfix <a href="postconf.5.html">main.cf</a> file syntax
  
         Table-driven mechanisms:
         <a href="access.5.html">access(5)</a>, Postfix SMTP access control table
***************
*** 282,287 ****
--- 282,295 ----
         IBM T.J. Watson Research
         P.O. Box 704
         Yorktown Heights, NY 10598, USA
+ 
+        TLS support by:
+        Lutz Jaenicke
+        Brandenburg University of Technology
+        Cottbus, Germany
+ 
+        Victor Duchovni
+        Morgan Stanley
  
         SASL support originally by:
         Till Franke
diff -cr /var/tmp/postfix-2.3.0/html/postsuper.1.html ./html/postsuper.1.html
*** /var/tmp/postfix-2.3.0/html/postsuper.1.html	Sat Dec  3 10:41:47 2005
--- ./html/postsuper.1.html	Sat Jul 22 21:29:05 2006
***************
*** 30,36 ****
         Options:
  
         <b>-c</b> <i>config</i><b>_</b><i>dir</i>
!               The  <b>main.cf</b>  configuration  file  is  in the named
                directory  instead  of  the  default  configuration
                directory.  See  also  the  MAIL_CONFIG environment
                setting below.
--- 30,36 ----
         Options:
  
         <b>-c</b> <i>config</i><b>_</b><i>dir</i>
!               The  <a href="postconf.5.html"><b>main.cf</b></a>  configuration  file  is  in the named
                directory  instead  of  the  default  configuration
                directory.  See  also  the  MAIL_CONFIG environment
                setting below.
***************
*** 136,147 ****
                case.
  
                A requeued message is moved to the <b>maildrop</b>  queue,
!               from  where  it is copied by the pickup daemon to a
!               new file whose name is guaranteed to match the  new
!               queue file inode number. The new queue file is sub-
!               jected again to mail address rewriting and  substi-
!               tution. This is useful when rewriting rules or vir-
!               tual mappings have changed.
  
                Warning: Postfix queue IDs are reused.  There is  a
                very  small  possibility that <a href="postsuper.1.html"><b>postsuper</b>(1)</a> requeues
--- 136,167 ----
                case.
  
                A requeued message is moved to the <b>maildrop</b>  queue,
!               from  where  it  is  copied  by  the  <a href="pickup.8.html"><b>pickup</b>(8)</a> and
!               <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemons to a new  queue  file.  In  many
!               respects  its  handling  differs from that of a new
!               local submission.
! 
!               <b>o</b>      The  message  is  not   subjected   to   the
!                      <a href="postconf.5.html#smtpd_milters">smtpd_milters</a> or <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a> settings.
!                      When mail has  passed  through  an  external
!                      content filter, this would produce incorrect
!                      results with Milter applications that depend
!                      on  original  SMTP connection state informa-
!                      tion.
! 
!               <b>o</b>      The  message  is  subjected  again  to  mail
!                      address rewriting and substitution.  This is
!                      useful when rewriting rules or virtual  map-
!                      pings have changed.
! 
!                      The  address  rewriting  context  (local  or
!                      remote) is the same as when the message  was
!                      received.
! 
!               <b>o</b>      The  message  is  subjected to the same <a href="postconf.5.html#content_filter">con</a>-
!                      <a href="postconf.5.html#content_filter">tent_filter</a> settings (if any)  as  used  for
!                      new  local mail submissions.  This is useful
!                      when <a href="postconf.5.html#content_filter">content_filter</a> settings have changed.
  
                Warning: Postfix queue IDs are reused.  There is  a
                very  small  possibility that <a href="postsuper.1.html"><b>postsuper</b>(1)</a> requeues
***************
*** 180,200 ****
  
  <b>ENVIRONMENT</b>
         MAIL_CONFIG
!               Directory with the <b>main.cf</b> file.
  
  <b>BUGS</b>
         Mail that is not sanitized by Postfix (i.e.  mail  in  the
         <b>maildrop</b> queue) cannot be placed "on hold".
  
  <b>CONFIGURATION PARAMETERS</b>
!        The  following  <b>main.cf</b> parameters are especially relevant
         to this program.  The text below provides only a parameter
         summary.  See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more details including exam-
         ples.
  
         <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
!               The default location of  the  Postfix  main.cf  and
!               master.cf configuration files.
  
         <b><a href="postconf.5.html#hash_queue_depth">hash_queue_depth</a> (1)</b>
                The  number of subdirectory levels for queue direc-
--- 200,220 ----
  
  <b>ENVIRONMENT</b>
         MAIL_CONFIG
!               Directory with the <a href="postconf.5.html"><b>main.cf</b></a> file.
  
  <b>BUGS</b>
         Mail that is not sanitized by Postfix (i.e.  mail  in  the
         <b>maildrop</b> queue) cannot be placed "on hold".
  
  <b>CONFIGURATION PARAMETERS</b>
!        The  following  <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant
         to this program.  The text below provides only a parameter
         summary.  See <a href="postconf.5.html"><b>postconf</b>(5)</a> for more details including exam-
         ples.
  
         <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
!               The default location of  the  Postfix  <a href="postconf.5.html">main.cf</a>  and
!               <a href="master.5.html">master.cf</a> configuration files.
  
         <b><a href="postconf.5.html#hash_queue_depth">hash_queue_depth</a> (1)</b>
                The  number of subdirectory levels for queue direc-
diff -cr /var/tmp/postfix-2.3.0/html/smtp.8.html ./html/smtp.8.html
*** /var/tmp/postfix-2.3.0/html/smtp.8.html	Tue Jul 11 20:19:22 2006
--- ./html/smtp.8.html	Wed Jul 19 17:44:23 2006
***************
*** 293,305 ****
  
         Available in Postfix version 2.3 and later:
  
-        <b><a href="postconf.5.html#smtp_sasl_auth_enforce">smtp_sasl_auth_enforce</a> (yes)</b>
-               If sender-dependent SASL passwords are turned  off,
-               defer  mail  delivery  when an SMTP server does not
-               support SASL authentication, while  <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_pass</a>-
-               <a href="postconf.5.html#smtp_sasl_password_maps">word_maps</a>  contains SASL login/password information
-               for that server.
- 
         <b><a href="postconf.5.html#smtp_sender_dependent_authentication">smtp_sender_dependent_authentication</a> (no)</b>
                Enable sender-dependent authentication in the Post-
                fix  SMTP  client; this is available only with SASL
--- 293,298 ----
***************
*** 386,391 ****
--- 379,394 ----
                Log the hostname  of  a  remote  SMTP  server  that
                offers  STARTTLS,  when  TLS is not already enabled
                for that server.
+ 
+        <b><a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> (empty)</b>
+               Optional lookup tables with the Postfix SMTP client
+               TLS security policy by next-hop destination; when a
+               non-empty value is specified,  this  overrides  the
+               obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter.
+ 
+        <b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (SSLv3, TLSv1)</b>
+               List  of TLS protocols that the Postfix SMTP client
+               will use with mandatory TLS encryption.
  
         <b><a href="postconf.5.html#smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a> (5)</b>
                The verification depth for remote SMTP server  cer-
diff -cr /var/tmp/postfix-2.3.0/html/smtpd.8.html ./html/smtpd.8.html
*** /var/tmp/postfix-2.3.0/html/smtpd.8.html	Tue Jul 11 20:19:22 2006
--- ./html/smtpd.8.html	Fri Jul 21 21:12:40 2006
***************
*** 130,135 ****
--- 130,142 ----
                Postpone the start  of  an  SMTP  mail  transaction
                until a valid RCPT TO command is received.
  
+        Available in Postfix version 2.3 and later:
+ 
+        <b><a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> (yes)</b>
+               Force  the  Postfix SMTP server to issue a TLS ses-
+               sion id, even when TLS session  caching  is  turned
+               off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a> is empty).
+ 
  <b>ADDRESS REWRITING CONTROLS</b>
         See  the  <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> document for a detailed
         discussion of Postfix address rewriting.
***************
*** 355,360 ****
--- 362,372 ----
                authority (CA) that issued the Postfix SMTP  server
                certificate.
  
+        <b><a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> (yes)</b>
+               Force  the  Postfix SMTP server to issue a TLS ses-
+               sion id, even when TLS session  caching  is  turned
+               off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a> is empty).
+ 
         <b><a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> (no)</b>
                Ask  a remote SMTP client for a client certificate.
  
***************
*** 694,702 ****
         Available in Postfix version 2.3 and later:
  
         <b><a href="postconf.5.html#smtpd_peername_lookup">smtpd_peername_lookup</a> (yes)</b>
!               Attempt to look up the Postfix  SMTP  client  host-
!               name,  and  verify that the name matches the client
!               IP address.
  
         The per SMTP client connection count and request rate lim-
         its are implemented in co-operation with the <a href="anvil.8.html"><b>anvil</b>(8)</a> ser-
--- 706,714 ----
         Available in Postfix version 2.3 and later:
  
         <b><a href="postconf.5.html#smtpd_peername_lookup">smtpd_peername_lookup</a> (yes)</b>
!               Attempt to look up the remote SMTP client hostname,
!               and  verify  that  the  name  matches the client IP
!               address.
  
         The per SMTP client connection count and request rate lim-
         its are implemented in co-operation with the <a href="anvil.8.html"><b>anvil</b>(8)</a> ser-
diff -cr /var/tmp/postfix-2.3.0/man/man1/postfix.1 ./man/man1/postfix.1
*** /var/tmp/postfix-2.3.0/man/man1/postfix.1	Sat Dec  3 18:51:42 2005
--- ./man/man1/postfix.1	Wed Jul 19 12:32:21 2006
***************
*** 259,264 ****
--- 259,272 ----
  P.O. Box 704
  Yorktown Heights, NY 10598, USA
  
+ TLS support by:
+ Lutz Jaenicke
+ Brandenburg University of Technology
+ Cottbus, Germany
+ 
+ Victor Duchovni
+ Morgan Stanley
+ 
  SASL support originally by:
  Till Franke
  SuSE Rhein/Main AG
diff -cr /var/tmp/postfix-2.3.0/man/man1/postsuper.1 ./man/man1/postsuper.1
*** /var/tmp/postfix-2.3.0/man/man1/postsuper.1	Sat Dec  3 10:41:46 2005
--- ./man/man1/postsuper.1	Sat Jul 22 21:29:05 2006
***************
*** 127,139 ****
  Specify \fB-r ALL\fR to requeue all messages. As a safety
  measure, the word \fBALL\fR must be specified in upper case.
  .sp
! A requeued message is moved to the \fBmaildrop\fR queue, from
! where it is copied by the pickup daemon to a new file whose name
! is guaranteed to match the new queue file inode number. The
! new queue file is subjected again to mail address rewriting and
! substitution. This is useful when rewriting rules or virtual
! mappings have changed.
  .sp
  Warning: Postfix queue IDs are reused.
  There is a very small possibility that \fBpostsuper\fR(1) requeues
  the wrong message file when it is executed while the Postfix mail
--- 127,157 ----
  Specify \fB-r ALL\fR to requeue all messages. As a safety
  measure, the word \fBALL\fR must be specified in upper case.
  .sp
! A requeued message is moved to the \fBmaildrop\fR queue,
! from where it is copied by the \fBpickup\fR(8) and
! \fBcleanup\fR(8) daemons to a new queue file. In many
! respects its handling differs from that of a new local
! submission.
! .RS
! .IP \(bu
! The message is not subjected to the smtpd_milters or
! non_smtpd_milters settings.  When mail has passed through
! an external content filter, this would produce incorrect
! results with Milter applications that depend on original
! SMTP connection state information.
! .IP \(bu
! The message is subjected again to mail address rewriting
! and substitution.  This is useful when rewriting rules or
! virtual mappings have changed.
  .sp
+ The address rewriting context (local or remote) is the same
+ as when the message was received.
+ .IP \(bu
+ The message is subjected to the same content_filter settings
+ (if any) as used for new local mail submissions.  This is
+ useful when content_filter settings have changed.
+ .RE
+ .IP
  Warning: Postfix queue IDs are reused.
  There is a very small possibility that \fBpostsuper\fR(1) requeues
  the wrong message file when it is executed while the Postfix mail
diff -cr /var/tmp/postfix-2.3.0/man/man5/postconf.5 ./man/man5/postconf.5
*** /var/tmp/postfix-2.3.0/man/man5/postconf.5	Tue Jul 11 20:17:37 2006
--- ./man/man5/postconf.5	Sat Jul 22 20:58:18 2006
***************
*** 1901,1911 ****
  The default time unit is s (seconds).
  .SH lmtp_sasl_auth_enable (default: no)
  Enable SASL authentication in the Postfix LMTP client.
- .SH lmtp_sasl_auth_enforce (default: yes)
- The LMTP-specific version of the smtp_sasl_auth_enforce
- configuration parameter.  See there for details.
- .PP
- This feature is available in Postfix 2.3 and later.
  .SH lmtp_sasl_mechanism_filter (default: empty)
  The LMTP-specific version of the smtp_sasl_mechanism_filter
  configuration parameter.  See there for details.
--- 1901,1906 ----
***************
*** 4218,4230 ****
  .fi
  .ad
  .ft R
- .SH smtp_sasl_auth_enforce (default: yes)
- If sender-dependent SASL passwords are turned off, defer mail
- delivery when an SMTP server does not support SASL authentication,
- while smtp_sasl_password_maps contains SASL login/password information
- for that server.
- .PP
- This feature is available in Postfix 2.3 and later.
  .SH smtp_sasl_mechanism_filter (default: empty)
  If non-empty, a Postfix SMTP client filter for the remote SMTP
  server's list of offered SASL mechanisms.  Different client and
--- 4213,4218 ----
***************
*** 5831,5837 ****
  The lookup key to be used in SMTP \fBaccess\fR(5) tables instead of the
  null sender address.
  .SH smtpd_peername_lookup (default: yes)
! Attempt to look up the Postfix SMTP client hostname, and verify that
  the name matches the client IP address. A client name is set to
  "unknown" when it cannot be looked up or verified, or when name
  lookup is disabled.  Turning off name lookup reduces delays due to
--- 5819,5825 ----
  The lookup key to be used in SMTP \fBaccess\fR(5) tables instead of the
  null sender address.
  .SH smtpd_peername_lookup (default: yes)
! Attempt to look up the remote SMTP client hostname, and verify that
  the name matches the client IP address. A client name is set to
  "unknown" when it cannot be looked up or verified, or when name
  lookup is disabled.  Turning off name lookup reduces delays due to
***************
*** 6457,6462 ****
--- 6445,6481 ----
  .ft R
  .PP
  This feature is available in Postfix 2.2 and later.
+ .SH smtpd_tls_always_issue_session_ids (default: yes)
+ Force the Postfix SMTP server to issue a TLS session id, even
+ when TLS session caching is turned off (smtpd_tls_session_cache_database
+ is empty). This behavior is compatible with Postfix < 2.3.
+ .PP
+ With Postfix 2.3 and later the Postfix SMTP server can disable
+ session id generation when TLS session caching is turned off. This
+ keeps clients from caching sessions that almost certainly cannot
+ be re-used.
+ .PP
+ By default, the Postfix SMTP server always generates TLS session
+ ids. This works around a known defect in mail client applications
+ such as MS Outlook, and may also prevent interoperability issues
+ with other MTAs.
+ .PP
+ Example:
+ .na
+ .nf
+ .in +4
+ .nf
+ .na
+ .ft C
+     smtpd_tls_always_issue_session_ids = no
+ .fi
+ .ad
+ .ft R
+ .in -4
+ .fi
+ .ad
+ .PP
+ This feature is available in Postfix 2.3 and later.
  .SH smtpd_tls_ask_ccert (default: no)
  Ask a remote SMTP client for a client certificate. This
  information is needed for certificate based mail relaying with,
diff -cr /var/tmp/postfix-2.3.0/man/man8/smtp.8 ./man/man8/smtp.8
*** /var/tmp/postfix-2.3.0/man/man8/smtp.8	Tue Jul 11 20:19:21 2006
--- ./man/man8/smtp.8	Wed Jul 19 17:44:23 2006
***************
*** 262,272 ****
  server's list of offered SASL mechanisms.
  .PP
  Available in Postfix version 2.3 and later:
- .IP "\fBsmtp_sasl_auth_enforce (yes)\fR"
- If sender-dependent SASL passwords are turned off, defer mail
- delivery when an SMTP server does not support SASL authentication,
- while smtp_sasl_password_maps contains SASL login/password information
- for that server.
  .IP "\fBsmtp_sender_dependent_authentication (no)\fR"
  Enable sender-dependent authentication in the Postfix SMTP client; this is
  available only with SASL authentication, and disables SMTP connection
--- 262,267 ----
***************
*** 327,332 ****
--- 322,334 ----
  .IP "\fBsmtp_tls_note_starttls_offer (no)\fR"
  Log the hostname of a remote SMTP server that offers STARTTLS,
  when TLS is not already enabled for that server.
+ .IP "\fBsmtp_tls_policy_maps (empty)\fR"
+ Optional lookup tables with the Postfix SMTP client TLS security
+ policy by next-hop destination; when a non-empty value is specified,
+ this overrides the obsolete smtp_tls_per_site parameter.
+ .IP "\fBsmtp_tls_mandatory_protocols (SSLv3, TLSv1)\fR"
+ List of TLS protocols that the Postfix SMTP client will use
+ with mandatory TLS encryption.
  .IP "\fBsmtp_tls_scert_verifydepth (5)\fR"
  The verification depth for remote SMTP server certificates.
  .IP "\fBsmtp_tls_secure_cert_match (nexthop, dot-nexthop)\fR"
diff -cr /var/tmp/postfix-2.3.0/man/man8/smtpd.8 ./man/man8/smtpd.8
*** /var/tmp/postfix-2.3.0/man/man8/smtpd.8	Tue Jul 11 20:19:21 2006
--- ./man/man8/smtpd.8	Fri Jul 21 21:12:39 2006
***************
*** 124,129 ****
--- 124,135 ----
  .IP "\fBsmtpd_delay_open_until_valid_rcpt (yes)\fR"
  Postpone the start of an SMTP mail transaction until a valid
  RCPT TO command is received.
+ .PP
+ Available in Postfix version 2.3 and later:
+ .IP "\fBsmtpd_tls_always_issue_session_ids (yes)\fR"
+ Force the Postfix SMTP server to issue a TLS session id, even
+ when TLS session caching is turned off (smtpd_tls_session_cache_database
+ is empty).
  .SH "ADDRESS REWRITING CONTROLS"
  .na
  .nf
***************
*** 310,315 ****
--- 316,325 ----
  .IP "\fBsmtpd_tls_CAfile (empty)\fR"
  The file with the certificate of the certification authority
  (CA) that issued the Postfix SMTP server certificate.
+ .IP "\fBsmtpd_tls_always_issue_session_ids (yes)\fR"
+ Force the Postfix SMTP server to issue a TLS session id, even
+ when TLS session caching is turned off (smtpd_tls_session_cache_database
+ is empty).
  .IP "\fBsmtpd_tls_ask_ccert (no)\fR"
  Ask a remote SMTP client for a client certificate.
  .IP "\fBsmtpd_tls_auth_only (no)\fR"
***************
*** 562,568 ****
  .PP
  Available in Postfix version 2.3 and later:
  .IP "\fBsmtpd_peername_lookup (yes)\fR"
! Attempt to look up the Postfix SMTP client hostname, and verify that
  the name matches the client IP address.
  .PP
  The per SMTP client connection count and request rate limits are
--- 572,578 ----
  .PP
  Available in Postfix version 2.3 and later:
  .IP "\fBsmtpd_peername_lookup (yes)\fR"
! Attempt to look up the remote SMTP client hostname, and verify that
  the name matches the client IP address.
  .PP
  The per SMTP client connection count and request rate limits are
diff -cr /var/tmp/postfix-2.3.0/mantools/postlink ./mantools/postlink
*** /var/tmp/postfix-2.3.0/mantools/postlink	Tue Jul 11 15:07:12 2006
--- ./mantools/postlink	Wed Jul 19 17:05:44 2006
***************
*** 253,259 ****
      s;\blmtp_rcpt_timeout\b;<a href="postconf.5.html#lmtp_rcpt_timeout">$&</a>;g;
      s;\blmtp_rset_timeout\b;<a href="postconf.5.html#lmtp_rset_timeout">$&</a>;g;
      s;\blmtp_sasl_auth_enable\b;<a href="postconf.5.html#lmtp_sasl_auth_enable">$&</a>;g;
-     s;\blmtp_sasl_auth_enforce\b;<a href="postconf.5.html#lmtp_sasl_auth_enforce">$&</a>;g;
      s;\blmtp_sasl_password_maps\b;<a href="postconf.5.html#lmtp_sasl_password_maps">$&</a>;g;
      s;\blmtp_sasl_security_options\b;<a href="postconf.5.html#lmtp_sasl_security_options">$&</a>;g;
      s;\blmtp_sasl_type\b;<a href="postconf.5.html#lmtp_sasl_type">$&</a>;g;
--- 253,258 ----
***************
*** 526,532 ****
      s;\bsmtp_[-</Bb>]*\n* *[<Bb>]*sasl_[-</Bb>]*\n* *[<Bb>]*tls_[-</Bb>]*\n* *[<Bb>]*secu[-</Bb>]*\n* *[<Bb>]*rity_options\b;<a href="postconf.5.html#smtp_sasl_tls_security_options">$&</a>;g;
      s;\bsmtp_sasl_tls_verified_secu[-</Bb>]*\n* *[<Bb>]*rity_options\b;<a href="postconf.5.html#smtp_sasl_tls_verified_security_options">$&</a>;g;
      s;\bsmtp_sasl_type\b;<a href="postconf.5.html#smtp_sasl_type">$&</a>;g;
-     s;\bsmtp_sasl_auth_enforce\b;<a href="postconf.5.html#smtp_sasl_auth_enforce">$&</a>;g;
      s;\bsmtp_starttls_timeout\b;<a href="postconf.5.html#smtp_starttls_timeout">$&</a>;g;
      s;\bsmtp_tls_CAfile\b;<a href="postconf.5.html#smtp_tls_CAfile">$&</a>;g;
      s;\bsmtp_tls_CApath\b;<a href="postconf.5.html#smtp_tls_CApath">$&</a>;g;
--- 525,530 ----
***************
*** 577,582 ****
--- 575,581 ----
      s;\bsmtpd_tls_req_ccert\b;<a href="postconf.5.html#smtpd_tls_req_ccert">$&</a>;g;
      s;\bsmtpd_tls_session_cache_database\b;<a href="postconf.5.html#smtpd_tls_session_cache_database">$&</a>;g;
      s;\bsmtpd_tls_session_cache_timeout\b;<a href="postconf.5.html#smtpd_tls_session_cache_timeout">$&</a>;g;
+     s;\bsmtpd_tls_always_issue_session_ids\b;<a href="postconf.5.html#smtpd_tls_always_issue_session_ids">$&</a>;g;
      s;\bsmtpd_tls_wrappermode\b;<a href="postconf.5.html#smtpd_tls_wrappermode">$&</a>;g;
      s;\bsmtpd_use_tls\b;<a href="postconf.5.html#smtpd_use_tls">$&</a>;g;
      s;\btls_daemon_random_bytes\b;<a href="postconf.5.html#tls_daemon_random_bytes">$&</a>;g;
diff -cr /var/tmp/postfix-2.3.0/proto/DB_README.html ./proto/DB_README.html
*** /var/tmp/postfix-2.3.0/proto/DB_README.html	Thu Mar 17 09:14:30 2005
--- ./proto/DB_README.html	Sun Jul 23 12:11:06 2006
***************
*** 112,118 ****
  Normally, Postfix builds with the default DB version that ships
  with the system. </p>
  
! <p> To build Postfix on BSD systems with a specific DB version,
  use a variant of the following commands: </p>
  
  <blockquote>
--- 112,118 ----
  Normally, Postfix builds with the default DB version that ships
  with the system. </p>
  
! <p> To build Postfix on BSD systems with a non-default DB version,
  use a variant of the following commands: </p>
  
  <blockquote>
diff -cr /var/tmp/postfix-2.3.0/proto/FILTER_README.html ./proto/FILTER_README.html
*** /var/tmp/postfix-2.3.0/proto/FILTER_README.html	Tue Jul 11 13:54:23 2006
--- ./proto/FILTER_README.html	Wed Jul 12 09:23:10 2006
***************
*** 634,645 ****
  the real client name IP address. See smtp(8) and XFORWARD_README
  for more information. </p>
  
! <li> <p> With "-o disable_mime_output_conversion=yes", the scan
! delivery agent will not convert 8BITMIME mail to quoted-printable
! form while delivering to the content filter, as that would invalidate
! domainkeys and other digital signatures.  This workaround is needed
! because some SMTP-based content filters don't announce 8BITMIME
! support, even though they can handle it just fine.  </p>
  
  </ul>
  
--- 634,643 ----
  the real client name IP address. See smtp(8) and XFORWARD_README
  for more information. </p>
  
! <li> <p> The "-o disable_mime_output_conversion=yes" is a workaround
! that prevents the breaking of domainkeys and other digital signatures.
! This is needed because some SMTP-based content filters don't announce
! 8BITMIME support, even though they can handle it just fine.  </p>
  
  </ul>
  
diff -cr /var/tmp/postfix-2.3.0/proto/LINUX_README.html ./proto/LINUX_README.html
*** /var/tmp/postfix-2.3.0/proto/LINUX_README.html	Sat Feb 26 14:30:29 2005
--- ./proto/LINUX_README.html	Sun Jul 23 10:11:07 2006
***************
*** 21,30 ****
  
  <p> Warning: if you can't compile Postfix because the file "db.h"
  isn't found, then you MUST install the Berkeley DB development
! package (package name: db???-devel-???) that comes with your Linux
! system. Only that package contains the files that correspond to the
! Berkeley DB version that is used by the system library routines.
  </p>
  
  <p> DO NOT download some Berkeley DB version from the network.
  Every Postfix program will dump core when it is built with a different
--- 21,39 ----
  
  <p> Warning: if you can't compile Postfix because the file "db.h"
  isn't found, then you MUST install the Berkeley DB development
! package (name: db???-devel-???) that matches your system library.
! You can find out what is installed with the rpm command. For example:
  </p>
+ 
+ <blockquote>
+ <pre>
+ $ <b>rpm -qf /usr/lib/libdb.so</b>
+ db4-4.3.29-2
+ </pre>
+ </blockquote>
+ 
+ <p> This means that you need to install db4-devel-4.3.29-2 (on
+ some systems, specify <tt>/lib/libdb.so</tt> in the rpm query). </p>
  
  <p> DO NOT download some Berkeley DB version from the network.
  Every Postfix program will dump core when it is built with a different
diff -cr /var/tmp/postfix-2.3.0/proto/MILTER_README.html ./proto/MILTER_README.html
*** /var/tmp/postfix-2.3.0/proto/MILTER_README.html	Tue Jul 11 17:22:25 2006
--- ./proto/MILTER_README.html	Fri Jul 21 10:51:41 2006
***************
*** 228,234 ****
  <blockquote>
  <pre>
  $ <b>gzcat sendmail-<i>x.y.z</i>.tar.gz | tar xf -</b>
! $ <b>cd sendmail-<i>x.y.z</i></b>
  $ <b>make</b>
  [...<i>lots of output omitted</i>...]
  </pre>
--- 228,234 ----
  <blockquote>
  <pre>
  $ <b>gzcat sendmail-<i>x.y.z</i>.tar.gz | tar xf -</b>
! $ <b>cd sendmail-<i>x.y.z</i>/libmilter</b>
  $ <b>make</b>
  [...<i>lots of output omitted</i>...]
  </pre>
***************
*** 521,526 ****
--- 521,529 ----
  <tr> <td> j </td> <td> Always </td> <td> value of myhostname </td>
  </tr>
  
+ <tr> <td> _ </td> <td> Always </td> <td> The validated client name
+ and address </td> </tr>
+ 
  <tr> <td> {auth_authen} </td> <td> MAIL, DATA, EOM </td> <td> SASL
  login name </td> </tr>
  
***************
*** 613,621 ****
  <h2><a name="workarounds">Workarounds</a></h2>
  
  <p> Content filters may break domain key etc. signatures. If you
! use an SMTP-based filter as described in FILTER_README, then you
! should add a line to master.cf with "disable_mime_output_conversion
! = yes", as described in the <a
  href="FILTER_README.html#advanced_filter">advanced content filter</a>
  example. </p>
  
--- 616,624 ----
  <h2><a name="workarounds">Workarounds</a></h2>
  
  <p> Content filters may break domain key etc. signatures. If you
! use an SMTP-based content filter, then you should add a line to
! master.cf with "-o disable_mime_output_conversion=yes" (note: no
! spaces around the "="), as described in the <a
  href="FILTER_README.html#advanced_filter">advanced content filter</a>
  example. </p>
  
diff -cr /var/tmp/postfix-2.3.0/proto/SASL_README.html ./proto/SASL_README.html
*** /var/tmp/postfix-2.3.0/proto/SASL_README.html	Fri Jun 30 20:49:32 2006
--- ./proto/SASL_README.html	Tue Jul 18 20:28:40 2006
***************
*** 127,133 ****
  
  <blockquote>
  <pre>
! % make makefiles CCARGS='-DUSE_SASL_AUTH -DDEF_SASL_SERVER=\"dovecot\"'
  </pre>
  </blockquote>
  
--- 127,133 ----
  
  <blockquote>
  <pre>
! % make makefiles CCARGS='-DUSE_SASL_AUTH -DDEF_SASL_SERVER_TYPE=\"dovecot\"'
  </pre>
  </blockquote>
  
***************
*** 138,144 ****
  
  <ul>
  
! <li> <p> The "-DDEF_SASL_SERVER" stuff is not necessary; it just
  makes Postfix configuration a little more convenient because you
  don't have to specify the SASL plug-in type in the Postfix main.cf
  file.  </p>
--- 138,144 ----
  
  <ul>
  
! <li> <p> The "-DDEF_SASL_SERVER_TYPE" stuff is not necessary; it just
  makes Postfix configuration a little more convenient because you
  don't have to specify the SASL plug-in type in the Postfix main.cf
  file.  </p>
diff -cr /var/tmp/postfix-2.3.0/proto/TLS_README.html ./proto/TLS_README.html
*** /var/tmp/postfix-2.3.0/proto/TLS_README.html	Tue Jul 11 19:21:38 2006
--- ./proto/TLS_README.html	Mon Jul 24 15:13:28 2006
***************
*** 490,497 ****
  
  <p> It is strictly discouraged to use this mode from main.cf. If
  you want to support this service, enable a special port in master.cf
! and specify "-o smtpd_tls_wrappermode = yes" as an smtpd(8) command
! line option.  Port 465 (smtps) was once chosen for this feature.
  </p>
  
  <p> Example: </p>
--- 490,498 ----
  
  <p> It is strictly discouraged to use this mode from main.cf. If
  you want to support this service, enable a special port in master.cf
! and specify "-o smtpd_tls_wrappermode=yes" (note: no space around
! the "=") as an smtpd(8) command line option.  Port 465 (smtps) was
! once chosen for this feature.
  </p>
  
  <p> Example: </p>
***************
*** 631,636 ****
--- 632,653 ----
  </pre>
  </blockquote>
  
+ <p> When the Postfix SMTP server does not save TLS sessions to an
+ external cache database, client-side session caching is unlikely
+ to be useful.  To prevent such wastage, the Postfix SMTP server can
+ be configured to not issue TLS session ids. By default the Postfix
+ SMTP server always issues TLS session ids. This works around known
+ interoperability issues with some MUAs, and prevents possible
+ interoperability issues with other MTAs. </p>
+ 
+ <p> Example: </p>
+ 
+ <blockquote>
+ <pre>
+     smtpd_tls_always_issue_session_ids = no
+ </pre>
+ </blockquote>
+ 
  <h3><a name="server_access">Server access control</a> </h3>
  
  <p> Postfix TLS support introduces three additional features for
***************
*** 1822,1831 ****
  <dl>
  
  <dt> remote SMTP server hostname </dt> <dd> This is simply the DNS
! name of the server that the Postfix SMTP client connects to; this name
! may be obtained from other DNS lookups, such as MX lookups or CNAME
! lookups. Use of the hostname lookup key is discouraged; always use the
! next-hop destination instead. </dd>
  
  <dt> next-hop destination </dt> <dd> This is normally the domain portion
  of the recipient address, but it may be overridden by information from
--- 1839,1848 ----
  <dl>
  
  <dt> remote SMTP server hostname </dt> <dd> This is simply the DNS
! name of the server that the Postfix SMTP client connects to; this
! name may be obtained from other DNS lookups, such as MX lookups or
! CNAME lookups. Use of the hostname lookup key is discouraged; always
! use the next-hop destination instead. </dd>
  
  <dt> next-hop destination </dt> <dd> This is normally the domain portion
  of the recipient address, but it may be overridden by information from
***************
*** 1924,1940 ****
  
  <ol>
  
! <li> <p> Use a dedicated transport for all secure-channel deliveries. </p>
  
  <li> <p> Eliminate MX lookups. Specify local transport(5) table
! entries for sensitive domains with explicit smtp:[<i>mailhost</i>]
! or smtp:[<i>mailhost</i>]:<i>port</i> destinations (you can assure
! security of this table unlike DNS); in the smtp_tls_per_site
! table, specify the value "MUST" for the key [<i>mailhost</i>] or
! smtp:[<i>mailhost</i>]:<i>port</i>. This prevents false hostname
! information in DNS MX records from changing Postfix's notion of the
! server hostname that is used for TLS policy lookup and server certificate
! verification. </p>
  
  <li> <p> Disallow CNAME hostname overrides. In main.cf, specify
  "smtp_cname_overrides_servername = no". This prevents false hostname
--- 1941,1959 ----
  
  <ol>
  
! <li> <p> Use a dedicated message delivery transport (for example,
! "securetls") as illustrated below. </p>
  
  <li> <p> Eliminate MX lookups. Specify local transport(5) table
! entries for sensitive domains with explicit securetls:[<i>mailhost</i>]
! or securetls:[<i>mailhost</i>]:<i>port</i> destinations (you can
! assure security of this table unlike DNS). This prevents false
! hostname information in DNS MX records from changing Postfix's
! notion of the server hostname that is used for TLS policy lookup
! and server certificate verification. The "securetls" transport is
! configured to enforce TLS with peername verification, and to disable
! the SMTP connection cache which could interfere with enforcement
! of smtp_tls_per_site policies. </p>
  
  <li> <p> Disallow CNAME hostname overrides. In main.cf, specify
  "smtp_cname_overrides_servername = no". This prevents false hostname
***************
*** 1971,1978 ****
  
  /etc/postfix/master.cf:
      securetls unix  -       -       n       -       100     smtp
-         -o smtp_connection_cache_on_demand=no
-         -o smtp_connection_cache_destinations=
          -o smtp_enforce_tls=yes
          -o smtp_tls_enforce_peername=yes
  </pre>
--- 1990,1995 ----
diff -cr /var/tmp/postfix-2.3.0/proto/postconf.proto ./proto/postconf.proto
*** /var/tmp/postfix-2.3.0/proto/postconf.proto	Tue Jul 11 20:14:05 2006
--- ./proto/postconf.proto	Sat Jul 22 20:57:51 2006
***************
*** 8941,8947 ****
  
  %PARAM smtpd_peername_lookup yes
  
! <p> Attempt to look up the Postfix SMTP client hostname, and verify that
  the name matches the client IP address. A client name is set to
  "unknown" when it cannot be looked up or verified, or when name
  lookup is disabled.  Turning off name lookup reduces delays due to
--- 8941,8947 ----
  
  %PARAM smtpd_peername_lookup yes
  
! <p> Attempt to look up the remote SMTP client hostname, and verify that
  the name matches the client IP address. A client name is set to
  "unknown" when it cannot be looked up or verified, or when name
  lookup is disabled.  Turning off name lookup reduces delays due to
***************
*** 10367,10388 ****
  
  <p> This feature is available in Postfix 2.3 and later. </p>
  
- %PARAM smtp_sasl_auth_enforce   yes
- 
- <p> If sender-dependent SASL passwords are turned off, defer mail
- delivery when an SMTP server does not support SASL authentication,
- while smtp_sasl_password_maps contains SASL login/password information
- for that server.  </p>
- 
- <p> This feature is available in Postfix 2.3 and later. </p>
- 
- %PARAM lmtp_sasl_auth_enforce   yes
- 
- <p> The LMTP-specific version of the smtp_sasl_auth_enforce
- configuration parameter.  See there for details. </p>
- 
- <p> This feature is available in Postfix 2.3 and later. </p>
- 
  %PARAM smtpd_tls_security_level
  
  <p> The SMTP TLS security level for the Postfix SMTP server; when
--- 10367,10372 ----
***************
*** 10442,10446 ****
--- 10426,10456 ----
  
  <p> NOTE: It's generally not safe to enable content inspection of
  Postfix-generated email messages. The user is warned. </p>
+ 
+ <p> This feature is available in Postfix 2.3 and later. </p>
+ 
+ %PARAM smtpd_tls_always_issue_session_ids yes
+ 
+ <p> Force the Postfix SMTP server to issue a TLS session id, even
+ when TLS session caching is turned off (smtpd_tls_session_cache_database
+ is empty). This behavior is compatible with Postfix &lt; 2.3. </p>
+ 
+ <p> With Postfix 2.3 and later the Postfix SMTP server can disable
+ session id generation when TLS session caching is turned off. This
+ keeps clients from caching sessions that almost certainly cannot
+ be re-used.  </p>
+ 
+ <p> By default, the Postfix SMTP server always generates TLS session
+ ids. This works around a known defect in mail client applications
+ such as MS Outlook, and may also prevent interoperability issues
+ with other MTAs. </p>
+ 
+ <p> Example: </p>
+ 
+ <blockquote>
+ <pre>
+     smtpd_tls_always_issue_session_ids = no
+ </pre>
+ </blockquote>
  
  <p> This feature is available in Postfix 2.3 and later. </p>
diff -cr /var/tmp/postfix-2.3.0/src/cleanup/cleanup.h ./src/cleanup/cleanup.h
*** /var/tmp/postfix-2.3.0/src/cleanup/cleanup.h	Tue Jul 11 13:06:05 2006
--- ./src/cleanup/cleanup.h	Thu Jul 20 20:14:48 2006
***************
*** 91,97 ****
--- 91,100 ----
  #endif
      MILTERS *milters;			/* mail filters */
      const char *client_name;		/* real or ersatz client */
+     const char *reverse_name;		/* real or ersatz client */
      const char *client_addr;		/* real or ersatz client */
+     int     client_af;			/* real or ersatz client */
+     const char *client_port;		/* real or ersatz client */
  } CLEANUP_STATE;
  
   /*
diff -cr /var/tmp/postfix-2.3.0/src/cleanup/cleanup_milter.c ./src/cleanup/cleanup_milter.c
*** /var/tmp/postfix-2.3.0/src/cleanup/cleanup_milter.c	Tue Jul 11 15:44:45 2006
--- ./src/cleanup/cleanup_milter.c	Mon Jul 24 14:59:37 2006
***************
*** 779,784 ****
--- 779,788 ----
       * The lookup result will never be a pointer record.
       * 
       * Index 1 is the first matching header instance.
+      * 
+      * XXX When a header is updated repeatedly we create jumps to jumps. To
+      * eliminate this, rewrite the loop below so that we can start with the
+      * pointer record that points to the header that's being edited.
       */
  #define DONT_SAVE_RECORD	0
  #define NO_PTR_BACKUP		0
***************
*** 826,832 ****
  		    avail_space += read_offset - saved_read_offset;
  		    jumped = 1;
  		}
! 		if (rec_goto(state->dst, STR(rec_buf)) < 0) {
  		    msg_warn("%s: read file %s: %m", myname, cleanup_path);
  		    CLEANUP_UPD_HEADER_RETURN(cleanup_milter_error(state,
  								   errno));
--- 830,837 ----
  		    avail_space += read_offset - saved_read_offset;
  		    jumped = 1;
  		}
! 		if (rec_goto(state->dst, STR(rec_buf)) < 0
! 		    || (read_offset = vstream_ftell(state->dst)) < 0) {
  		    msg_warn("%s: read file %s: %m", myname, cleanup_path);
  		    CLEANUP_UPD_HEADER_RETURN(cleanup_milter_error(state,
  								   errno));
***************
*** 1215,1226 ****
      /*
       * Connect macros.
       */
      if (strcmp(name, S8_MAC_J) == 0)
  	return (var_myhostname);
      if (strcmp(name, S8_MAC_CLIENT_ADDR) == 0)
! 	return (nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_ADDR));
      if (strcmp(name, S8_MAC_CLIENT_NAME) == 0)
! 	return (nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_NAME));
  
      /*
       * MAIL FROM macros.
--- 1220,1240 ----
      /*
       * Connect macros.
       */
+     if (strcmp(name, S8_MAC__) == 0) {
+ 	vstring_sprintf(state->temp1, "%s [%s]",
+ 			state->reverse_name, state->client_addr);
+ 	if (strcasecmp(state->client_name, state->reverse_name) != 0)
+ 	    vstring_strcat(state->temp1, " (may be forged)");
+ 	return (STR(state->temp1));
+     }
      if (strcmp(name, S8_MAC_J) == 0)
  	return (var_myhostname);
      if (strcmp(name, S8_MAC_CLIENT_ADDR) == 0)
! 	return (state->client_addr);
      if (strcmp(name, S8_MAC_CLIENT_NAME) == 0)
! 	return (state->client_name);
!     if (strcmp(name, S8_MAC_CLIENT_PTR) == 0)
! 	return (state->reverse_name);
  
      /*
       * MAIL FROM macros.
***************
*** 1278,1283 ****
--- 1292,1303 ----
  	msg_info("%s: %s", myname, resp);
  
      /*
+      * Sanity check.
+      */
+     if (state->client_name == 0)
+ 	msg_panic("%s: missing client info initialization", myname);
+ 
+     /*
       * We don't report errors that were already reported by the content
       * editing call-back routines. See cleanup_milter_error() above.
       */
***************
*** 1354,1359 ****
--- 1374,1411 ----
      return (ret);
  }
  
+ /* cleanup_milter_client_init - initialize real or ersatz client info */
+ 
+ static void cleanup_milter_client_init(CLEANUP_STATE *state)
+ {
+     const char *proto_attr;
+ 
+     /*
+      * Either the cleanup client specifies a name, address and protocol, or
+      * we have a local submission and pretend localhost/127.0.0.1/AF_INET.
+      */
+ #define NO_CLIENT_PORT	"0"
+ 
+     state->client_name = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_NAME);
+     state->reverse_name =
+ 	nvtable_find(state->attr, MAIL_ATTR_ACT_REVERSE_CLIENT_NAME);
+     state->client_addr = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_ADDR);
+     state->client_port = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_PORT);
+     proto_attr = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_AF);
+ 
+     if (state->client_name == 0 || state->client_addr == 0 || proto_attr == 0
+ 	|| !alldig(proto_attr)) {
+ 	state->client_name = "localhost";
+ 	state->client_addr = "127.0.0.1";
+ 	state->client_af = AF_INET;
+     } else
+ 	state->client_af = atoi(proto_attr);
+     if (state->reverse_name == 0)
+ 	state->reverse_name = state->client_name;
+     if (state->client_port == 0)
+ 	state->client_port = NO_CLIENT_PORT;
+ }
+ 
  /* cleanup_milter_inspect - run message through mail filter */
  
  void    cleanup_milter_inspect(CLEANUP_STATE *state, MILTERS *milters)
***************
*** 1365,1370 ****
--- 1417,1428 ----
  	msg_info("enter %s", myname);
  
      /*
+      * Initialize, in case we're called via smtpd(8).
+      */
+     if (state->client_name == 0)
+ 	cleanup_milter_client_init(state);
+ 
+     /*
       * Process mail filter replies. The reply format is verified by the mail
       * filter library.
       */
***************
*** 1382,1390 ****
  				         const char *addr)
  {
      const char *resp;
-     const char *proto_attr;
-     const char *client_port;
-     int     client_af;
      const char *helo;
      const char *argv[2];
  
--- 1440,1445 ----
***************
*** 1397,1429 ****
  			 cleanup_ins_header, cleanup_del_header,
  			 cleanup_add_rcpt, cleanup_del_rcpt,
  			 cleanup_repl_body, (void *) state);
! 
!     /*
!      * Either the cleanup client specifies a name, address and protocol, or
!      * we have a local submission and pretend localhost/127.0.0.1/AF_INET.
!      */
! #define NO_CLIENT_PORT	"0"
! 
!     state->client_name = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_NAME);
!     state->client_addr = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_ADDR);
! 
!     client_port = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_PORT);
!     proto_attr = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_AF);
!     if (state->client_name == 0 || state->client_addr == 0 || proto_attr == 0
! 	|| !alldig(proto_attr)) {
! 	state->client_name = "localhost";
! 	state->client_addr = "127.0.0.1";
! 	client_af = AF_INET;
!     } else
! 	client_af = atoi(proto_attr);
!     if (client_port == 0)
! 	client_port = NO_CLIENT_PORT;
  
      /*
       * Emulate SMTP events.
       */
      if ((resp = milter_conn_event(milters, state->client_name, state->client_addr,
! 				  client_port, client_af)) != 0) {
  	cleanup_milter_apply(state, "CONNECT", resp);
  	return;
      }
--- 1452,1465 ----
  			 cleanup_ins_header, cleanup_del_header,
  			 cleanup_add_rcpt, cleanup_del_rcpt,
  			 cleanup_repl_body, (void *) state);
!     if (state->client_name == 0)
! 	cleanup_milter_client_init(state);
  
      /*
       * Emulate SMTP events.
       */
      if ((resp = milter_conn_event(milters, state->client_name, state->client_addr,
! 			      state->client_port, state->client_af)) != 0) {
  	cleanup_milter_apply(state, "CONNECT", resp);
  	return;
      }
***************
*** 1453,1462 ****
--- 1489,1505 ----
  				         MILTERS *milters,
  				         const char *addr)
  {
+     const char *myname = "cleanup_milter_emul_rcpt";
      const char *resp;
      const char *argv[2];
  
      /*
+      * Sanity check.
+      */
+     if (state->client_name == 0)
+ 	msg_panic("%s: missing client info initialization", myname);
+ 
+     /*
       * CLEANUP_STAT_CONT and CLEANUP_STAT_DEFER both update the reason
       * attribute, but CLEANUP_STAT_DEFER takes precedence. It terminates
       * queue record processing, and prevents bounces from being sent.
***************
*** 1479,1486 ****
--- 1522,1536 ----
  
  void    cleanup_milter_emul_data(CLEANUP_STATE *state, MILTERS *milters)
  {
+     const char *myname = "cleanup_milter_emul_data";
      const char *resp;
  
+     /*
+      * Sanity check.
+      */
+     if (state->client_name == 0)
+ 	msg_panic("%s: missing client info initialization", myname);
+ 
      if ((resp = milter_data_event(milters)) != 0)
  	cleanup_milter_apply(state, "DATA", resp);
  }
***************
*** 1716,1722 ****
  		msg_warn("bad add_header argument count: %d", argv->argc);
  	    } else {
  		flatten_args(arg_buf, argv->argv + 2);
! 		cleanup_add_header(state, argv->argv[2], STR(arg_buf));
  	    }
  	} else if (strcmp(argv->argv[0], "ins_header") == 0) {
  	    if (argv->argc < 3) {
--- 1766,1772 ----
  		msg_warn("bad add_header argument count: %d", argv->argc);
  	    } else {
  		flatten_args(arg_buf, argv->argv + 2);
! 		cleanup_add_header(state, argv->argv[1], STR(arg_buf));
  	    }
  	} else if (strcmp(argv->argv[0], "ins_header") == 0) {
  	    if (argv->argc < 3) {
diff -cr /var/tmp/postfix-2.3.0/src/cleanup/cleanup_milter.in1 ./src/cleanup/cleanup_milter.in1
*** /var/tmp/postfix-2.3.0/src/cleanup/cleanup_milter.in1	Mon May 15 07:33:30 2006
--- ./src/cleanup/cleanup_milter.in1	Mon Jul 24 14:29:53 2006
***************
*** 9,12 ****
--- 9,14 ----
  del_header 2 X-Test-Header
  ins_header 3 X-Test-Header test header value 3
  upd_header 1 X X-replaced-header replacement header text
+ upd_header 1 X X-replaced-header replacement header text
+ upd_header 1 X X-replaced-header replacement header text
  close
diff -cr /var/tmp/postfix-2.3.0/src/cleanup/cleanup_milter.ref1 ./src/cleanup/cleanup_milter.ref1
*** /var/tmp/postfix-2.3.0/src/cleanup/cleanup_milter.ref1	Mon May 15 07:35:31 2006
--- ./src/cleanup/cleanup_milter.ref1	Mon Jul 24 14:29:56 2006
***************
*** 38,45 ****
       1353 pointer_record:            1193
       1193 deleted_text: X-Test-Header: test header value 1
       1229 pointer_record:            1370
!      1370 regular_text: X: X-replaced-header replacement header text
!      1416 pointer_record:             881
        881 regular_text: Y: 1234567
        893 regular_text: Message-Id: <20060514010427.E0F703D1E36@tail.porcupine.org>
        954 regular_text: Date: Sat, 13 May 2006 21:04:18 -0400 (EDT)
--- 38,47 ----
       1353 pointer_record:            1193
       1193 deleted_text: X-Test-Header: test header value 1
       1229 pointer_record:            1370
!      1370 pointer_record:            1433
!      1433 pointer_record:            1496
!      1496 regular_text: X: X-replaced-header replacement header text
!      1542 pointer_record:             881
        881 regular_text: Y: 1234567
        893 regular_text: Message-Id: <20060514010427.E0F703D1E36@tail.porcupine.org>
        954 regular_text: Date: Sat, 13 May 2006 21:04:18 -0400 (EDT)
diff -cr /var/tmp/postfix-2.3.0/src/cleanup/cleanup_state.c ./src/cleanup/cleanup_state.c
*** /var/tmp/postfix-2.3.0/src/cleanup/cleanup_state.c	Tue Jul 11 13:06:30 2006
--- ./src/cleanup/cleanup_state.c	Thu Jul 20 20:14:48 2006
***************
*** 109,115 ****
--- 109,118 ----
      state->verp_delims = 0;
      state->milters = 0;
      state->client_name = 0;
+     state->reverse_name = 0;
      state->client_addr = 0;
+     state->client_af = 0;
+     state->client_port = 0;
      return (state);
  }
  
diff -cr /var/tmp/postfix-2.3.0/src/global/mail_params.h ./src/global/mail_params.h
*** /var/tmp/postfix-2.3.0/src/global/mail_params.h	Tue Jul 11 20:07:35 2006
--- ./src/global/mail_params.h	Tue Jul 18 21:11:49 2006
***************
*** 1183,1188 ****
--- 1183,1192 ----
  #define DEF_SMTPD_TLS_SCACHTIME	"3600s"
  extern int var_smtpd_tls_scache_timeout;
  
+ #define VAR_SMTPD_TLS_SET_SESSID	"smtpd_tls_always_issue_session_ids"
+ #define DEF_SMTPD_TLS_SET_SESSID	1
+ extern bool var_smtpd_tls_set_sessid;
+ 
  #define VAR_SMTPD_DELAY_OPEN	"smtpd_delay_open_until_valid_rcpt"
  #define DEF_SMTPD_DELAY_OPEN	1
  extern bool var_smtpd_delay_open;
diff -cr /var/tmp/postfix-2.3.0/src/milter/milter8.c ./src/milter/milter8.c
*** /var/tmp/postfix-2.3.0/src/milter/milter8.c	Tue Jul 11 10:41:13 2006
--- ./src/milter/milter8.c	Thu Jul 20 16:06:11 2006
***************
*** 488,494 ****
  /* milter8_read_resp - receive command code now, receive data later */
  
  static int milter8_read_resp(MILTER8 *milter, int event, unsigned char *command,
! 			            ssize_t *data_len)
  {
      UINT32_TYPE len;
      ssize_t pkt_len;
--- 488,494 ----
  /* milter8_read_resp - receive command code now, receive data later */
  
  static int milter8_read_resp(MILTER8 *milter, int event, unsigned char *command,
! 			             ssize_t *data_len)
  {
      UINT32_TYPE len;
      ssize_t pkt_len;
***************
*** 963,968 ****
--- 963,972 ----
  #define IN_CONNECT_EVENT(e) ((e) == SMFIC_CONNECT || (e) == SMFIC_HELO)
  
      for (;;) {
+ 	char   *cp;
+ 	char   *rp;
+ 	char    ch;
+ 
  	if (milter8_read_resp(milter, event, &cmd, &data_size) != 0)
  	    return (milter->def_reply);
  	if (msg_verbose)
***************
*** 1081,1086 ****
--- 1085,1095 ----
  	     * Decision: "ddd d.d+.d+ text". This decision is final (i.e.
  	     * Sendmail 8 changes receiver state). Note: the reply may be in
  	     * multi-line SMTP format.
+ 	     * 
+ 	     * XXX Sendmail compatibility: sendmail 8 uses the reply as a format
+ 	     * string; therefore any '%' characters in the reply are doubled.
+ 	     * Postfix doesn't use replies as format strings; we replace '%%'
+ 	     * by '%', and remove single (i.e. invalid) '%' characters.
  	     */
  	case SMFIR_REPLYCODE:
  	    if (milter8_read_data(milter, data_size,
***************
*** 1096,1101 ****
--- 1105,1119 ----
  			 milter->m.name, STR(milter->buf));
  		milter8_conf_error(milter);
  		return (milter->def_reply);
+ 	    }
+ 	    if ((rp = cp = strchr(STR(milter->buf), '%')) != 0) {
+ 		for (;;) {
+ 		    if ((ch = *cp++) == '%')
+ 			ch = *cp++;
+ 		    *rp++ = ch;
+ 		    if (ch == 0)
+ 			break;
+ 		}
  	    }
  	    if (IN_CONNECT_EVENT(event)) {
  #ifdef LIBMILTER_AUTO_DISCONNECT
diff -cr /var/tmp/postfix-2.3.0/src/milter/test-list ./src/milter/test-list
*** /var/tmp/postfix-2.3.0/src/milter/test-list	Sat Jul  1 20:47:42 2006
--- ./src/milter/test-list	Thu Jul 20 15:55:50 2006
***************
*** 1,3 ****
--- 1,13 ----
+ # Reject with text 
+ ./test-milter -C 1 -a "554 5.7.1 1% 2%% 3%%%" -c connect -p inet:9999@127.0.0.1
+ ./test-milter -C 1 -a "554 5.7.1 1% 2%% 3%%%" -c helo -p inet:9999@127.0.0.1
+ ./test-milter -C 1 -a "554 5.7.1 1% 2%% 3%%%" -c mail -p inet:9999@127.0.0.1
+ ./test-milter -C 1 -a "554 5.7.1 1% 2%% 3%%%" -c rcpt -p inet:9999@127.0.0.1
+ ./test-milter -C 1 -a "554 5.7.1 1% 2%% 3%%%" -c header -p inet:9999@127.0.0.1
+ ./test-milter -C 1 -a "554 5.7.1 1% 2%% 3%%%" -c eoh -p inet:9999@127.0.0.1
+ ./test-milter -C 1 -a "554 5.7.1 1% 2%% 3%%%" -c body -p inet:9999@127.0.0.1
+ ./test-milter -C 1 -a "554 5.7.1 1% 2%% 3%%%" -c eom -p inet:9999@127.0.0.1
+ 
  # Tempfail tests
  ./test-milter -C 1 -a tempfail -c connect -p inet:9999@127.0.0.1
  ./test-milter -C 1 -a tempfail -c helo -p inet:9999@127.0.0.1
diff -cr /var/tmp/postfix-2.3.0/src/milter/test-milter.c ./src/milter/test-milter.c
*** /var/tmp/postfix-2.3.0/src/milter/test-milter.c	Wed Jul  5 11:09:55 2006
--- ./src/milter/test-milter.c	Thu Jul 20 11:33:53 2006
***************
*** 96,112 ****
  static char *reply_dsn;
  static char *reply_message;
  
  static char *ins_hdr;
  static int ins_idx;
  static char *ins_val;
  
  static char *chg_hdr;
  static int chg_idx;
  static char *chg_val;
  
  static int test_reply(SMFICTX *ctx, int code)
  {
!     (void) fflush(stdout);			/* In case output redirected. */
  
      if (code == SMFIR_REPLYCODE) {
  	if (smfi_setreply(ctx, reply_code, reply_dsn, reply_message) != MI_SUCCESS)
--- 96,118 ----
  static char *reply_dsn;
  static char *reply_message;
  
+ #ifdef SMFIR_INSHEADER
  static char *ins_hdr;
  static int ins_idx;
  static char *ins_val;
  
+ #endif
+ 
+ #ifdef SMFIR_CHGHEADER
  static char *chg_hdr;
  static int chg_idx;
  static char *chg_val;
  
+ #endif
+ 
  static int test_reply(SMFICTX *ctx, int code)
  {
!     (void) fflush(stdout);		/* In case output redirected. */
  
      if (code == SMFIR_REPLYCODE) {
  	if (smfi_setreply(ctx, reply_code, reply_dsn, reply_message) != MI_SUCCESS)
***************
*** 214,223 ****
--- 220,233 ----
  static sfsistat test_eom(SMFICTX *ctx)
  {
      printf("test_eom\n");
+ #ifdef SMFIR_INSHEADER
      if (ins_hdr && smfi_insheader(ctx, ins_idx, ins_hdr, ins_val) == MI_FAILURE)
  	fprintf(stderr, "smfi_insheader failed");
+ #endif
+ #ifdef SMFIR_CHGHEADER
      if (chg_hdr && smfi_chgheader(ctx, chg_hdr, chg_idx, chg_val) == MI_FAILURE)
  	fprintf(stderr, "smfi_chgheader failed");
+ #endif
      return (test_reply(ctx, test_eom_reply));
  }
  
***************
*** 319,329 ****
--- 329,344 ----
  	    }
  	    break;
  	case 'i':
+ #ifdef SMFIR_INSHEADER
  	    if (ins_hdr) {
  		fprintf(stderr, "too many -i options\n");
  		exit(1);
  	    }
  	    parse_hdr_info(optarg, &ins_idx, &ins_hdr, &ins_val);
+ #else
+ 	    fprintf(stderr, "no libmilter support to insert header\n");
+ 	    exit(1);
+ #endif
  	    break;
  	case 'p':
  	    if (smfi_setconn(optarg) == MI_FAILURE) {
***************
*** 332,342 ****
--- 347,362 ----
  	    }
  	    break;
  	case 'r':
+ #ifdef SMFIR_CHGHEADER
  	    if (chg_hdr) {
  		fprintf(stderr, "too many -r options\n");
  		exit(1);
  	    }
  	    parse_hdr_info(optarg, &chg_idx, &chg_hdr, &chg_val);
+ #else
+ 	    fprintf(stderr, "no libmilter support to change header\n");
+ 	    exit(1);
+ #endif
  	    break;
  	case 'v':
  	    verbose++;
diff -cr /var/tmp/postfix-2.3.0/src/pickup/pickup.c ./src/pickup/pickup.c
*** /var/tmp/postfix-2.3.0/src/pickup/pickup.c	Sun Jun  4 19:04:49 2006
--- ./src/pickup/pickup.c	Sat Jul 22 14:55:53 2006
***************
*** 221,229 ****
       * mail system against unreasonable inputs. This also requires that we
       * limit the size of envelope records written by the local posting agent.
       * 
!      * Allow attribute records if the queue file is owned by the mail system
!      * (postsuper -r) or if the attribute specifies the MIME body type
!      * (sendmail -B).
       * 
       * We must allow PTR records here because of "postsuper -r".
       */
--- 221,227 ----
       * mail system against unreasonable inputs. This also requires that we
       * limit the size of envelope records written by the local posting agent.
       * 
!      * Records with named attributes are filtered by postdrop(1).
       * 
       * We must allow PTR records here because of "postsuper -r".
       */
***************
*** 249,254 ****
--- 247,254 ----
  	/*
  	 * XXX Workaround: REC_TYPE_FILT (used in envelopes) == REC_TYPE_CONT
  	 * (used in message content).
+ 	 * 
+ 	 * As documented in postsuper(1), ignore content filter record.
  	 */
  	if (*expected != REC_TYPE_CONTENT[0]) {
  	    if (type == REC_TYPE_FILT)
***************
*** 322,328 ****
      }
  
      /*
!      * Add content inspection transport.
       */
      if (*var_filter_xport)
  	rec_fprintf(cleanup, REC_TYPE_FILT, "%s", var_filter_xport);
--- 322,328 ----
      }
  
      /*
!      * Add content inspection transport. See also postsuper(1).
       */
      if (*var_filter_xport)
  	rec_fprintf(cleanup, REC_TYPE_FILT, "%s", var_filter_xport);
***************
*** 344,350 ****
       * For messages belonging to $mail_owner also log the maildrop queue id.
       * This supports message tracking for mail requeued via "postsuper -r".
       */
!     if (info->st.st_uid == var_owner_uid) {
  	msg_info("%s: uid=%d from=<%s> orig_id=%s", info->id,
  		 (int) info->st.st_uid, info->sender,
  		 ((name = strrchr(info->path, '/')) != 0 ?
--- 344,353 ----
       * For messages belonging to $mail_owner also log the maildrop queue id.
       * This supports message tracking for mail requeued via "postsuper -r".
       */
! #define MAIL_IS_REQUEUED(info) \
!     ((info)->st.st_uid == var_owner_uid && ((info)->st.st_mode & S_IROTH) == 0)
! 
!     if (MAIL_IS_REQUEUED(info)) {
  	msg_info("%s: uid=%d from=<%s> orig_id=%s", info->id,
  		 (int) info->st.st_uid, info->sender,
  		 ((name = strrchr(info->path, '/')) != 0 ?
***************
*** 442,447 ****
--- 445,457 ----
       * bounces its copy of the message. because the original input file is
       * not readable by the bounce service.
       * 
+      * If mail is re-injected with "postsuper -r", disable Milter applications.
+      * If they were run before the mail was queued then there is no need to
+      * run them again. Moreover, the queue file does not contain enough
+      * information to reproduce the exact same SMTP events and Sendmail
+      * macros that Milters received when the mail originally arrived in
+      * Postfix.
+      * 
       * The actual message copying code is in a separate routine, so that it is
       * easier to implement the many possible error exits without forgetting
       * to close files, or to release memory.
***************
*** 449,454 ****
--- 459,467 ----
      cleanup_flags =
  	input_transp_cleanup(CLEANUP_FLAG_BOUNCE | CLEANUP_FLAG_MASK_EXTERNAL,
  			     pickup_input_transp_mask);
+     /* As documented in postsuper(1). */
+     if (MAIL_IS_REQUEUED(info))
+ 	cleanup_flags &= ~CLEANUP_FLAG_MILTER;
  
      cleanup = mail_connect_wait(MAIL_CLASS_PUBLIC, var_cleanup_service);
      if (attr_scan(cleanup, ATTR_FLAG_STRICT,
diff -cr /var/tmp/postfix-2.3.0/src/postfix/postfix.c ./src/postfix/postfix.c
*** /var/tmp/postfix-2.3.0/src/postfix/postfix.c	Sat Dec  3 18:32:48 2005
--- ./src/postfix/postfix.c	Wed Jul 19 12:30:05 2006
***************
*** 239,244 ****
--- 239,252 ----
  /*	P.O. Box 704
  /*	Yorktown Heights, NY 10598, USA
  /*
+ /*	TLS support by:
+ /*	Lutz Jaenicke
+ /*	Brandenburg University of Technology
+ /*	Cottbus, Germany
+ /*
+ /*	Victor Duchovni
+ /*	Morgan Stanley
+ /*
  /*	SASL support originally by:
  /*	Till Franke
  /*	SuSE Rhein/Main AG
diff -cr /var/tmp/postfix-2.3.0/src/postsuper/postsuper.c ./src/postsuper/postsuper.c
*** /var/tmp/postfix-2.3.0/src/postsuper/postsuper.c	Sat Dec  3 09:56:40 2005
--- ./src/postsuper/postsuper.c	Sat Jul 22 21:28:52 2006
***************
*** 121,133 ****
  /*	Specify \fB-r ALL\fR to requeue all messages. As a safety
  /*	measure, the word \fBALL\fR must be specified in upper case.
  /* .sp
! /*	A requeued message is moved to the \fBmaildrop\fR queue, from
! /*	where it is copied by the pickup daemon to a new file whose name
! /*	is guaranteed to match the new queue file inode number. The
! /*	new queue file is subjected again to mail address rewriting and
! /*	substitution. This is useful when rewriting rules or virtual
! /*	mappings have changed.
  /* .sp
  /*	Warning: Postfix queue IDs are reused.
  /*	There is a very small possibility that \fBpostsuper\fR(1) requeues
  /*	the wrong message file when it is executed while the Postfix mail
--- 121,151 ----
  /*	Specify \fB-r ALL\fR to requeue all messages. As a safety
  /*	measure, the word \fBALL\fR must be specified in upper case.
  /* .sp
! /*	A requeued message is moved to the \fBmaildrop\fR queue,
! /*	from where it is copied by the \fBpickup\fR(8) and
! /*	\fBcleanup\fR(8) daemons to a new queue file. In many
! /*	respects its handling differs from that of a new local
! /*	submission.
! /* .RS
! /* .IP \(bu
! /*	The message is not subjected to the smtpd_milters or
! /*	non_smtpd_milters settings.  When mail has passed through
! /*	an external content filter, this would produce incorrect
! /*	results with Milter applications that depend on original
! /*	SMTP connection state information.
! /* .IP \(bu
! /*	The message is subjected again to mail address rewriting
! /*	and substitution.  This is useful when rewriting rules or
! /*	virtual mappings have changed.
  /* .sp
+ /*	The address rewriting context (local or remote) is the same
+ /*	as when the message was received.
+ /* .IP \(bu
+ /*	The message is subjected to the same content_filter settings
+ /*	(if any) as used for new local mail submissions.  This is
+ /*	useful when content_filter settings have changed.
+ /* .RE
+ /* .IP
  /*	Warning: Postfix queue IDs are reused.
  /*	There is a very small possibility that \fBpostsuper\fR(1) requeues
  /*	the wrong message file when it is executed while the Postfix mail
diff -cr /var/tmp/postfix-2.3.0/src/smtp/lmtp_params.c ./src/smtp/lmtp_params.c
*** /var/tmp/postfix-2.3.0/src/smtp/lmtp_params.c	Mon Jul 10 20:50:55 2006
--- ./src/smtp/lmtp_params.c	Wed Jul 19 17:05:57 2006
***************
*** 95,100 ****
  #endif
  	VAR_LMTP_SENDER_AUTH, DEF_LMTP_SENDER_AUTH, &var_smtp_sender_auth,
  	VAR_LMTP_CNAME_OVERR, DEF_LMTP_CNAME_OVERR, &var_smtp_cname_overr,
- 	VAR_LMTP_SASL_ENFORCE, DEF_LMTP_SASL_ENFORCE, &var_smtp_sasl_enforce,
  	0,
      };
--- 95,99 ----
diff -cr /var/tmp/postfix-2.3.0/src/smtp/smtp.c ./src/smtp/smtp.c
*** /var/tmp/postfix-2.3.0/src/smtp/smtp.c	Tue Jul 11 20:19:21 2006
--- ./src/smtp/smtp.c	Wed Jul 19 17:04:25 2006
***************
*** 234,244 ****
  /*	server's list of offered SASL mechanisms.
  /* .PP
  /*	Available in Postfix version 2.3 and later:
- /* .IP "\fBsmtp_sasl_auth_enforce (yes)\fR"
- /*	If sender-dependent SASL passwords are turned off, defer mail
- /*	delivery when an SMTP server does not support SASL authentication,
- /*	while smtp_sasl_password_maps contains SASL login/password information
- /*	for that server.
  /* .IP "\fBsmtp_sender_dependent_authentication (no)\fR"
  /*	Enable sender-dependent authentication in the Postfix SMTP client; this is
  /*	available only with SASL authentication, and disables SMTP connection
--- 234,239 ----
***************
*** 297,302 ****
--- 292,304 ----
  /* .IP "\fBsmtp_tls_note_starttls_offer (no)\fR"
  /*	Log the hostname of a remote SMTP server that offers STARTTLS,
  /*	when TLS is not already enabled for that server.
+ /* .IP "\fBsmtp_tls_policy_maps (empty)\fR"
+ /*	Optional lookup tables with the Postfix SMTP client TLS security
+ /*	policy by next-hop destination; when a non-empty value is specified,
+ /*	this overrides the obsolete smtp_tls_per_site parameter.
+ /* .IP "\fBsmtp_tls_mandatory_protocols (SSLv3, TLSv1)\fR"
+ /*	List of TLS protocols that the Postfix SMTP client will use
+ /*	with mandatory TLS encryption.
  /* .IP "\fBsmtp_tls_scert_verifydepth (5)\fR"
  /*	The verification depth for remote SMTP server certificates.
  /* .IP "\fBsmtp_tls_secure_cert_match (nexthop, dot-nexthop)\fR"
***************
*** 697,703 ****
  char   *var_lmtp_tcp_port;
  int     var_scache_proto_tmout;
  bool    var_smtp_cname_overr;
- bool    var_smtp_sasl_enforce;
  
   /*
    * Global variables.
--- 699,704 ----
diff -cr /var/tmp/postfix-2.3.0/src/smtp/smtp_params.c ./src/smtp/smtp_params.c
*** /var/tmp/postfix-2.3.0/src/smtp/smtp_params.c	Mon Jul 10 20:50:55 2006
--- ./src/smtp/smtp_params.c	Wed Jul 19 17:04:59 2006
***************
*** 99,104 ****
  #endif
  	VAR_SMTP_SENDER_AUTH, DEF_SMTP_SENDER_AUTH, &var_smtp_sender_auth,
  	VAR_SMTP_CNAME_OVERR, DEF_SMTP_CNAME_OVERR, &var_smtp_cname_overr,
- 	VAR_SMTP_SASL_ENFORCE, DEF_SMTP_SASL_ENFORCE, &var_smtp_sasl_enforce,
  	0,
      };
--- 99,103 ----
diff -cr /var/tmp/postfix-2.3.0/src/smtp/smtp_proto.c ./src/smtp/smtp_proto.c
*** /var/tmp/postfix-2.3.0/src/smtp/smtp_proto.c	Tue Jul 11 10:12:53 2006
--- ./src/smtp/smtp_proto.c	Wed Jul 19 20:47:51 2006
***************
*** 359,365 ****
  				       "host %s refused to talk to me: %s",
  				       session->namaddr,
  				       translit(resp->str, "\n", " ")));
- 	    return (0);
  	}
      } else {
  	where = "performing the LHLO handshake";
--- 359,364 ----
***************
*** 372,464 ****
      }
  
      /*
!      * Determine what server EHLO keywords to ignore, typically to avoid
!      * inter-operability problems.
       */
!     if (smtp_ehlo_dis_maps == 0
! 	|| (ehlo_words = maps_find(smtp_ehlo_dis_maps, state->session->addr, 0)) == 0)
! 	ehlo_words = var_smtp_ehlo_dis_words;
!     discard_mask = ehlo_mask(ehlo_words);
!     if (discard_mask && !(discard_mask & EHLO_MASK_SILENT))
! 	msg_info("discarding EHLO keywords: %s", str_ehlo_mask(discard_mask));
  
!     /*
!      * Pick up some useful features offered by the SMTP server. XXX Until we
!      * have a portable routine to convert from string to off_t with proper
!      * overflow detection, ignore the message size limit advertised by the
!      * SMTP server. Otherwise, we might do the wrong thing when the server
!      * advertises a really huge message size limit.
!      * 
!      * XXX Allow for "code (SP|-) ehlo-keyword (SP|=) ehlo-param...", because
!      * MicroSoft implemented AUTH based on an old draft.
!      */
!     lines = resp->str;
!     for (n = 0; (words = mystrtok(&lines, "\n")) != 0; /* see below */ ) {
! 	if (mystrtok(&words, "- ") && (word = mystrtok(&words, " \t=")) != 0) {
! 	    if (n == 0) {
! 		if (session->helo != 0)
! 		    myfree(session->helo);
! 
! 		/*
! 		 * XXX: Keep the original case: we don't expect a single SMTP
! 		 * server to randomly change the case of its helo response.
! 		 * If different capitalization is detected, we should assume
! 		 * disjoint TLS caches.
! 		 */
! 		session->helo = mystrdup(word);
! 		if (strcasecmp(word, var_myhostname) == 0
! 		 && (state->misc_flags & SMTP_MISC_FLAG_LOOP_DETECT) != 0) {
! 		    msg_warn("host %s replied to HELO/EHLO with my own hostname %s",
! 			     session->namaddrport, var_myhostname);
! 		    if (session->features & SMTP_FEATURE_BEST_MX)
! 			return (smtp_site_fail(state, DSN_BY_LOCAL_MTA,
  					     SMTP_RESP_FAKE(&fake, "5.4.6"),
  					 "mail for %s loops back to myself",
! 					       request->nexthop));
! 		    else
! 			return (smtp_site_fail(state, DSN_BY_LOCAL_MTA,
  					     SMTP_RESP_FAKE(&fake, "4.4.6"),
  					 "mail for %s loops back to myself",
! 					       request->nexthop));
! 		}
! 	    } else if (strcasecmp(word, "8BITMIME") == 0) {
! 		if ((discard_mask & EHLO_MASK_8BITMIME) == 0)
! 		    session->features |= SMTP_FEATURE_8BITMIME;
! 	    } else if (strcasecmp(word, "PIPELINING") == 0) {
! 		if ((discard_mask & EHLO_MASK_PIPELINING) == 0)
! 		    session->features |= SMTP_FEATURE_PIPELINING;
! 	    } else if (strcasecmp(word, "XFORWARD") == 0) {
! 		if ((discard_mask & EHLO_MASK_XFORWARD) == 0)
! 		    while ((word = mystrtok(&words, " \t")) != 0)
! 			session->features |= name_code(xforward_features,
! 						 NAME_CODE_FLAG_NONE, word);
! 	    } else if (strcasecmp(word, "SIZE") == 0) {
! 		if ((discard_mask & EHLO_MASK_SIZE) == 0) {
! 		    session->features |= SMTP_FEATURE_SIZE;
! 		    if ((word = mystrtok(&words, " \t")) != 0) {
! 			if (!alldig(word))
! 			    msg_warn("bad EHLO SIZE limit \"%s\" from %s",
! 				     word, session->namaddrport);
! 			else
! 			    session->size_limit = off_cvt_string(word);
  		    }
- 		}
  #ifdef USE_TLS
! 	    } else if (strcasecmp(word, "STARTTLS") == 0) {
! 		/* Ignored later if we already sent STARTTLS. */
! 		if ((discard_mask & EHLO_MASK_STARTTLS) == 0)
! 		    session->features |= SMTP_FEATURE_STARTTLS;
  #endif
  #ifdef USE_SASL_AUTH
! 	    } else if (var_smtp_sasl_enable && strcasecmp(word, "AUTH") == 0) {
! 		if ((discard_mask & EHLO_MASK_AUTH) == 0)
! 		    smtp_sasl_helo_auth(session, words);
  #endif
! 	    } else if (strcasecmp(word, "DSN") == 0) {
! 		if ((discard_mask & EHLO_MASK_DSN) == 0)
! 		    session->features |= SMTP_FEATURE_DSN;
  	    }
- 	    n++;
  	}
      }
      if (msg_verbose)
--- 371,476 ----
      }
  
      /*
!      * No early returns allowed, to ensure consistent handling of TLS and
!      * SASL policies.
       */
!     if (session->features & SMTP_FEATURE_ESMTP) {
  
! 	/*
! 	 * Determine what server EHLO keywords to ignore, typically to avoid
! 	 * inter-operability problems.
! 	 */
! 	if (smtp_ehlo_dis_maps == 0
! 	    || (ehlo_words = maps_find(smtp_ehlo_dis_maps,
! 				       state->session->addr, 0)) == 0)
! 	    ehlo_words = var_smtp_ehlo_dis_words;
! 	discard_mask = ehlo_mask(ehlo_words);
! 	if (discard_mask && !(discard_mask & EHLO_MASK_SILENT))
! 	    msg_info("discarding EHLO keywords: %s",
! 		     str_ehlo_mask(discard_mask));
! 
! 	/*
! 	 * Pick up some useful features offered by the SMTP server. XXX Until
! 	 * we have a portable routine to convert from string to off_t with
! 	 * proper overflow detection, ignore the message size limit
! 	 * advertised by the SMTP server. Otherwise, we might do the wrong
! 	 * thing when the server advertises a really huge message size limit.
! 	 * 
! 	 * XXX Allow for "code (SP|-) ehlo-keyword (SP|=) ehlo-param...",
! 	 * because MicroSoft implemented AUTH based on an old draft.
! 	 */
! 	lines = resp->str;
! 	for (n = 0; (words = mystrtok(&lines, "\n")) != 0; /* see below */ ) {
! 	    if (mystrtok(&words, "- ")
! 		&& (word = mystrtok(&words, " \t=")) != 0) {
! 		if (n == 0) {
! 		    if (session->helo != 0)
! 			myfree(session->helo);
! 
! 		    /*
! 		     * XXX: Keep the original case: we don't expect a single
! 		     * SMTP server to randomly change the case of its helo
! 		     * response. If different capitalization is detected, we
! 		     * should assume disjoint TLS caches.
! 		     */
! 		    session->helo = mystrdup(word);
! 		    if (strcasecmp(word, var_myhostname) == 0
! 			&& (state->misc_flags & SMTP_MISC_FLAG_LOOP_DETECT) != 0) {
! 			msg_warn("host %s replied to HELO/EHLO"
! 				 " with my own hostname %s",
! 				 session->namaddrport, var_myhostname);
! 			if (session->features & SMTP_FEATURE_BEST_MX)
! 			    return (smtp_site_fail(state, DSN_BY_LOCAL_MTA,
  					     SMTP_RESP_FAKE(&fake, "5.4.6"),
  					 "mail for %s loops back to myself",
! 						   request->nexthop));
! 			else
! 			    return (smtp_site_fail(state, DSN_BY_LOCAL_MTA,
  					     SMTP_RESP_FAKE(&fake, "4.4.6"),
  					 "mail for %s loops back to myself",
! 						   request->nexthop));
! 		    }
! 		} else if (strcasecmp(word, "8BITMIME") == 0) {
! 		    if ((discard_mask & EHLO_MASK_8BITMIME) == 0)
! 			session->features |= SMTP_FEATURE_8BITMIME;
! 		} else if (strcasecmp(word, "PIPELINING") == 0) {
! 		    if ((discard_mask & EHLO_MASK_PIPELINING) == 0)
! 			session->features |= SMTP_FEATURE_PIPELINING;
! 		} else if (strcasecmp(word, "XFORWARD") == 0) {
! 		    if ((discard_mask & EHLO_MASK_XFORWARD) == 0)
! 			while ((word = mystrtok(&words, " \t")) != 0)
! 			    session->features |=
! 				name_code(xforward_features,
! 					  NAME_CODE_FLAG_NONE, word);
! 		} else if (strcasecmp(word, "SIZE") == 0) {
! 		    if ((discard_mask & EHLO_MASK_SIZE) == 0) {
! 			session->features |= SMTP_FEATURE_SIZE;
! 			if ((word = mystrtok(&words, " \t")) != 0) {
! 			    if (!alldig(word))
! 				msg_warn("bad EHLO SIZE limit \"%s\" from %s",
! 					 word, session->namaddrport);
! 			    else
! 				session->size_limit = off_cvt_string(word);
! 			}
  		    }
  #ifdef USE_TLS
! 		} else if (strcasecmp(word, "STARTTLS") == 0) {
! 		    /* Ignored later if we already sent STARTTLS. */
! 		    if ((discard_mask & EHLO_MASK_STARTTLS) == 0)
! 			session->features |= SMTP_FEATURE_STARTTLS;
  #endif
  #ifdef USE_SASL_AUTH
! 		} else if (var_smtp_sasl_enable
! 			   && strcasecmp(word, "AUTH") == 0) {
! 		    if ((discard_mask & EHLO_MASK_AUTH) == 0)
! 			smtp_sasl_helo_auth(session, words);
  #endif
! 		} else if (strcasecmp(word, "DSN") == 0) {
! 		    if ((discard_mask & EHLO_MASK_DSN) == 0)
! 			session->features |= SMTP_FEATURE_DSN;
! 		}
! 		n++;
  	    }
  	}
      }
      if (msg_verbose)
***************
*** 600,615 ****
  #ifdef USE_SASL_AUTH
      if (var_smtp_sasl_enable && (session->features & SMTP_FEATURE_AUTH))
  	return (smtp_sasl_helo_login(state));
-     else if (var_smtp_sasl_enable
- 	     && *var_smtp_sasl_passwd
- 	     && !var_smtp_sender_auth
- 	     && var_smtp_sasl_enforce
- 	     && smtp_sasl_passwd_lookup(session) != 0)
- 	return (smtp_site_fail(state, DSN_BY_LOCAL_MTA,
- 			       SMTP_RESP_FAKE(&fake, "4.7.0"),
- 			       "SASL login/password exists, but host %s "
- 			       "does not announce SASL authentication support",
- 			       session->namaddr));
  #endif
  
      return (0);
--- 612,617 ----
***************
*** 744,754 ****
  	DONT_USE_DEAD_SESSION;
  
  	/*
! 	 * If TLS is optional, try again, this time without TLS.
! 	 * Specifically, this session is not final, don't defer any
! 	 * recipients yet.
  	 */
! 	if (session->tls_level == TLS_LEV_MAY)
  	    RETRY_AS_PLAINTEXT;
  	return (smtp_site_fail(state, DSN_BY_LOCAL_MTA,
  			       SMTP_RESP_FAKE(&fake, "4.7.5"),
--- 746,767 ----
  	DONT_USE_DEAD_SESSION;
  
  	/*
! 	 * If TLS is optional, try delivery to the same server over a
! 	 * plaintext connection. Otherwise we would defer mail forever with
! 	 * destinations that have no alternate MX host.
! 	 * 
! 	 * Don't fall back to plaintext if we were willing to use SASL-over-TLS
! 	 * authentication. If the server doesn't announce SASL support over
! 	 * plaintext connections, then we don't want delivery to fail with
! 	 * "relay access denied".
  	 */
! 	if (session->tls_level == TLS_LEV_MAY
! #ifdef USE_SASL_AUTH
! 	    && !(var_smtp_sasl_enable
! 		 && *var_smtp_sasl_passwd
! 		 && smtp_sasl_passwd_lookup(session))
! #endif
! 	    )
  	    RETRY_AS_PLAINTEXT;
  	return (smtp_site_fail(state, DSN_BY_LOCAL_MTA,
  			       SMTP_RESP_FAKE(&fake, "4.7.5"),
diff -cr /var/tmp/postfix-2.3.0/src/smtp/smtp_sasl_glue.c ./src/smtp/smtp_sasl_glue.c
*** /var/tmp/postfix-2.3.0/src/smtp/smtp_sasl_glue.c	Mon Jun 26 08:59:19 2006
--- ./src/smtp/smtp_sasl_glue.c	Wed Jul 19 16:03:31 2006
***************
*** 175,183 ****
  	 && (value = mail_addr_find(smtp_sasl_passwd_map,
  				 state->request->sender, (char **) 0)) != 0)
  	|| (value = maps_find(smtp_sasl_passwd_map, session->host, 0)) != 0
! 	|| (value = maps_find(smtp_sasl_passwd_map, session->dest, 0)) != 0) {
  	session->sasl_username = mystrdup(value);
  	passwd = split_at(session->sasl_username, ':');
  	session->sasl_passwd = mystrdup(passwd ? passwd : "");
  	if (msg_verbose)
  	    msg_info("%s: host `%s' user `%s' pass `%s'",
--- 175,187 ----
  	 && (value = mail_addr_find(smtp_sasl_passwd_map,
  				 state->request->sender, (char **) 0)) != 0)
  	|| (value = maps_find(smtp_sasl_passwd_map, session->host, 0)) != 0
!       || (value = maps_find(smtp_sasl_passwd_map, session->dest, 0)) != 0) {
! 	if (session->sasl_username)
! 	    myfree(session->sasl_username);
  	session->sasl_username = mystrdup(value);
  	passwd = split_at(session->sasl_username, ':');
+ 	if (session->sasl_passwd)
+ 	    myfree(session->sasl_passwd);
  	session->sasl_passwd = mystrdup(passwd ? passwd : "");
  	if (msg_verbose)
  	    msg_info("%s: host `%s' user `%s' pass `%s'",
diff -cr /var/tmp/postfix-2.3.0/src/smtpd/smtpd.c ./src/smtpd/smtpd.c
*** /var/tmp/postfix-2.3.0/src/smtpd/smtpd.c	Tue Jul 11 20:19:21 2006
--- ./src/smtpd/smtpd.c	Fri Jul 21 20:46:31 2006
***************
*** 108,113 ****
--- 108,119 ----
  /* .IP "\fBsmtpd_delay_open_until_valid_rcpt (yes)\fR"
  /*	Postpone the start of an SMTP mail transaction until a valid
  /*	RCPT TO command is received.
+ /* .PP
+ /*	Available in Postfix version 2.3 and later:
+ /* .IP "\fBsmtpd_tls_always_issue_session_ids (yes)\fR"
+ /*	Force the Postfix SMTP server to issue a TLS session id, even
+ /*	when TLS session caching is turned off (smtpd_tls_session_cache_database
+ /*	is empty).
  /* ADDRESS REWRITING CONTROLS
  /* .ad
  /* .fi
***************
*** 278,283 ****
--- 284,293 ----
  /* .IP "\fBsmtpd_tls_CAfile (empty)\fR"
  /*	The file with the certificate of the certification authority
  /*	(CA) that issued the Postfix SMTP server certificate.
+ /* .IP "\fBsmtpd_tls_always_issue_session_ids (yes)\fR"
+ /*	Force the Postfix SMTP server to issue a TLS session id, even
+ /*	when TLS session caching is turned off (smtpd_tls_session_cache_database
+ /*	is empty).
  /* .IP "\fBsmtpd_tls_ask_ccert (no)\fR"
  /*	Ask a remote SMTP client for a client certificate.
  /* .IP "\fBsmtpd_tls_auth_only (no)\fR"
***************
*** 520,526 ****
  /* .PP
  /*	Available in Postfix version 2.3 and later:
  /* .IP "\fBsmtpd_peername_lookup (yes)\fR"
! /*	Attempt to look up the Postfix SMTP client hostname, and verify that
  /*	the name matches the client IP address.
  /* .PP
  /*	The per SMTP client connection count and request rate limits are
--- 530,536 ----
  /* .PP
  /*	Available in Postfix version 2.3 and later:
  /* .IP "\fBsmtpd_peername_lookup (yes)\fR"
! /*	Attempt to look up the remote SMTP client hostname, and verify that
  /*	the name matches the client IP address.
  /* .PP
  /*	The per SMTP client connection count and request rate limits are
***************
*** 1070,1075 ****
--- 1080,1086 ----
  bool    var_smtpd_tls_received_header;
  bool    var_smtpd_tls_req_ccert;
  int     var_smtpd_tls_scache_timeout;
+ bool    var_smtpd_tls_set_sessid;
  int     var_tls_daemon_rand_bytes;
  
  #endif
***************
*** 1520,1526 ****
      if (state->helo_name) {
  	myfree(state->helo_name);
  	state->helo_name = 0;
! 	if (smtpd_milters)
  	    milter_abort(smtpd_milters);
      }
  }
--- 1531,1537 ----
      if (state->helo_name) {
  	myfree(state->helo_name);
  	state->helo_name = 0;
! 	if (SMTPD_STAND_ALONE(state) == 0 && smtpd_milters != 0)
  	    milter_abort(smtpd_milters);
      }
  }
***************
*** 1689,1694 ****
--- 1700,1707 ----
  	    rec_fprintf(state->cleanup, REC_TYPE_ATTR, "%s=%s",
  			MAIL_ATTR_ACT_CLIENT_NAME, state->name);
  	    rec_fprintf(state->cleanup, REC_TYPE_ATTR, "%s=%s",
+ 		    MAIL_ATTR_ACT_REVERSE_CLIENT_NAME, state->reverse_name);
+ 	    rec_fprintf(state->cleanup, REC_TYPE_ATTR, "%s=%s",
  			MAIL_ATTR_ACT_CLIENT_ADDR, state->addr);
  	    if (state->helo_name)
  		rec_fprintf(state->cleanup, REC_TYPE_ATTR, "%s=%s",
***************
*** 2235,2244 ****
  		smtpd_chat_reply(state, "501 5.7.1 DSN support is disabled");
  		return (-1);
  	    }
  	    if (dsn_orcpt_addr
! 		|| (coded_addr = split_at(arg + 6, ';')) == 0
  		|| xtext_unquote(state->dsn_buf, coded_addr) == 0
! 		|| *(dsn_orcpt_type = arg + 6) == 0) {
  		state->error_mask |= MAIL_ERROR_PROTOCOL;
  		smtpd_chat_reply(state,
  			     "501 5.5.4 Error: Bad ORCPT parameter syntax");
--- 2248,2258 ----
  		smtpd_chat_reply(state, "501 5.7.1 DSN support is disabled");
  		return (-1);
  	    }
+ 	    vstring_strcpy(state->dsn_orcpt_buf, arg + 6);
  	    if (dsn_orcpt_addr
! 		|| (coded_addr = split_at(STR(state->dsn_orcpt_buf), ';')) == 0
  		|| xtext_unquote(state->dsn_buf, coded_addr) == 0
! 		|| *(dsn_orcpt_type = STR(state->dsn_orcpt_buf)) == 0) {
  		state->error_mask |= MAIL_ERROR_PROTOCOL;
  		smtpd_chat_reply(state,
  			     "501 5.5.4 Error: Bad ORCPT parameter syntax");
***************
*** 4218,4223 ****
--- 4232,4238 ----
  	    props.verifydepth = var_smtpd_tls_ccert_vd;
  	    props.cache_type = TLS_MGR_SCACHE_SMTPD;
  	    props.scache_timeout = var_smtpd_tls_scache_timeout;
+ 	    props.set_sessid = var_smtpd_tls_set_sessid;
  	    props.cert_file = var_smtpd_tls_cert_file;
  	    props.key_file = var_smtpd_tls_key_file;
  	    props.dcert_file = var_smtpd_tls_dcert_file;
***************
*** 4250,4263 ****
  		msg_warn("Can't require client certs unless TLS is required");
  
  	    props.cipherlist =
! 	    	tls_cipher_list(enforce_tls ?
! 				    tls_cipher_level(var_smtpd_tls_mand_ciph) :
! 				    TLS_CIPHER_EXPORT,
  				var_smtpd_tls_excl_ciph,
  				havecert ? "" : "aRSA aDSS",
  				wantcert ? "aNULL" : "",
! 				enforce_tls ?  var_smtpd_tls_mand_excl :
! 				    TLS_END_EXCLUDE,
  				TLS_END_EXCLUDE);
  
  	    if (props.cipherlist == 0) {
--- 4265,4278 ----
  		msg_warn("Can't require client certs unless TLS is required");
  
  	    props.cipherlist =
! 		tls_cipher_list(enforce_tls ?
! 				tls_cipher_level(var_smtpd_tls_mand_ciph) :
! 				TLS_CIPHER_EXPORT,
  				var_smtpd_tls_excl_ciph,
  				havecert ? "" : "aRSA aDSS",
  				wantcert ? "aNULL" : "",
! 				enforce_tls ? var_smtpd_tls_mand_excl :
! 				TLS_END_EXCLUDE,
  				TLS_END_EXCLUDE);
  
  	    if (props.cipherlist == 0) {
***************
*** 4268,4275 ****
  				    var_smtpd_tls_excl_ciph,
  				    havecert ? "" : "aRSA aDSS",
  				    wantcert ? "aNULL" : "",
! 				    enforce_tls ?  var_smtpd_tls_mand_excl :
! 					TLS_END_EXCLUDE,
  				    TLS_END_EXCLUDE);
  	    }
  	    if (havecert || oknocert)
--- 4283,4290 ----
  				    var_smtpd_tls_excl_ciph,
  				    havecert ? "" : "aRSA aDSS",
  				    wantcert ? "aNULL" : "",
! 				    enforce_tls ? var_smtpd_tls_mand_excl :
! 				    TLS_END_EXCLUDE,
  				    TLS_END_EXCLUDE);
  	    }
  	    if (havecert || oknocert)
***************
*** 4439,4444 ****
--- 4454,4460 ----
  	VAR_SMTPD_TLS_ACERT, DEF_SMTPD_TLS_ACERT, &var_smtpd_tls_ask_ccert,
  	VAR_SMTPD_TLS_RCERT, DEF_SMTPD_TLS_RCERT, &var_smtpd_tls_req_ccert,
  	VAR_SMTPD_TLS_RECHEAD, DEF_SMTPD_TLS_RECHEAD, &var_smtpd_tls_received_header,
+ 	VAR_SMTPD_TLS_SET_SESSID, DEF_SMTPD_TLS_SET_SESSID, &var_smtpd_tls_set_sessid,
  #endif
  	VAR_SMTPD_PEERNAME_LOOKUP, DEF_SMTPD_PEERNAME_LOOKUP, &var_smtpd_peername_lookup,
  	VAR_SMTPD_DELAY_OPEN, DEF_SMTPD_DELAY_OPEN, &var_smtpd_delay_open,
diff -cr /var/tmp/postfix-2.3.0/src/smtpd/smtpd.h ./src/smtpd/smtpd.h
*** /var/tmp/postfix-2.3.0/src/smtpd/smtpd.h	Sun Jul  9 15:49:21 2006
--- ./src/smtpd/smtpd.h	Fri Jul 21 20:47:28 2006
***************
*** 145,150 ****
--- 145,151 ----
      char   *dsn_envid;			/* temporary MAIL FROM state */
      int     dsn_ret;			/* temporary MAIL FROM state */
      VSTRING *dsn_buf;			/* scratch space for xtext expansion */
+     VSTRING *dsn_orcpt_buf;		/* scratch space for ORCPT parsing */
  
      /*
       * Pass-through proxy client.
diff -cr /var/tmp/postfix-2.3.0/src/smtpd/smtpd_milter.c ./src/smtpd/smtpd_milter.c
*** /var/tmp/postfix-2.3.0/src/smtpd/smtpd_milter.c	Thu May 18 17:24:03 2006
--- ./src/smtpd/smtpd_milter.c	Thu Jul 20 20:14:48 2006
***************
*** 78,83 ****
--- 78,92 ----
      /*
       * Connect macros.
       */
+     if (strcmp(name, S8_MAC__) == 0) {
+ 	if (state->expand_buf == 0)
+ 	    state->expand_buf = vstring_alloc(10);
+ 	vstring_sprintf(state->expand_buf, "%s [%s]",
+ 			state->reverse_name, state->addr);
+ 	if (strcasecmp(state->name, state->reverse_name) != 0)
+ 	    vstring_strcat(state->expand_buf, " (may be forged)");
+ 	return (STR(state->expand_buf));
+     }
      if (strcmp(name, S8_MAC_J) == 0)
  	return (var_myhostname);
      if (strcmp(name, S8_MAC_CLIENT_ADDR) == 0)
diff -cr /var/tmp/postfix-2.3.0/src/smtpd/smtpd_state.c ./src/smtpd/smtpd_state.c
*** /var/tmp/postfix-2.3.0/src/smtpd/smtpd_state.c	Tue May  9 20:05:09 2006
--- ./src/smtpd/smtpd_state.c	Fri Jul 21 21:50:42 2006
***************
*** 137,142 ****
--- 137,143 ----
  #endif
      state->dsn_envid = 0;
      state->dsn_buf = vstring_alloc(100);
+     state->dsn_orcpt_buf = vstring_alloc(100);
  #ifdef USE_TLS
      state->tls_use_tls = 0;
      state->tls_enforce_tls = 0;
***************
*** 212,217 ****
--- 213,220 ----
  	vstring_free(state->instance);
      if (state->dsn_buf)
  	vstring_free(state->dsn_buf);
+     if (state->dsn_orcpt_buf)
+ 	vstring_free(state->dsn_orcpt_buf);
  
  #ifdef USE_SASL_AUTH
      if (var_smtpd_sasl_enable)
diff -cr /var/tmp/postfix-2.3.0/src/tls/tls.h ./src/tls/tls.h
*** /var/tmp/postfix-2.3.0/src/tls/tls.h	Sun Jul  9 11:33:17 2006
--- ./src/tls/tls.h	Wed Jul 19 11:33:01 2006
***************
*** 17,23 ****
  #include <name_code.h>
  
   /*
!   * TLS enforcement levels. Non-sentinel values also be used to indicate
    * the actual security level of a session.
    */
  #define TLS_LEV_NOTFOUND	-1	/* sentinel */
--- 17,23 ----
  #include <name_code.h>
  
   /*
!   * TLS enforcement levels. Non-sentinel values may also be used to indicate
    * the actual security level of a session.
    */
  #define TLS_LEV_NOTFOUND	-1	/* sentinel */
***************
*** 174,179 ****
--- 174,180 ----
      int     verifydepth;
      const char *cache_type;
      long    scache_timeout;
+     int     set_sessid;
      const char *cert_file;
      const char *key_file;
      const char *dcert_file;
diff -cr /var/tmp/postfix-2.3.0/src/tls/tls_server.c ./src/tls/tls_server.c
*** /var/tmp/postfix-2.3.0/src/tls/tls_server.c	Wed Jul  5 15:57:21 2006
--- ./src/tls/tls_server.c	Tue Jul 18 21:11:49 2006
***************
*** 447,453 ****
  	tls_print_errors();
  	cachable = 0;
      }
!     if (cachable) {
  
  	/*
  	 * Initialize the session cache.
--- 447,453 ----
  	tls_print_errors();
  	cachable = 0;
      }
!     if (cachable || props->set_sessid) {
  
  	/*
  	 * Initialize the session cache.
***************
*** 474,481 ****
  	SSL_CTX_set_session_cache_mode(server_ctx,
  				       SSL_SESS_CACHE_SERVER |
  				       SSL_SESS_CACHE_NO_AUTO_CLEAR);
! 	SSL_CTX_sess_set_get_cb(server_ctx, get_server_session_cb);
! 	SSL_CTX_sess_set_new_cb(server_ctx, new_server_session_cb);
  
  	/*
  	 * OpenSSL ignores timed-out sessions. We need to set the internal
--- 474,483 ----
  	SSL_CTX_set_session_cache_mode(server_ctx,
  				       SSL_SESS_CACHE_SERVER |
  				       SSL_SESS_CACHE_NO_AUTO_CLEAR);
! 	if (cachable) {
! 	    SSL_CTX_sess_set_get_cb(server_ctx, get_server_session_cb);
! 	    SSL_CTX_sess_set_new_cb(server_ctx, new_server_session_cb);
! 	}
  
  	/*
  	 * OpenSSL ignores timed-out sessions. We need to set the internal