HISTORY

	would have treated [text] as a domain name anyway.

	Bugfix: the $local_duplicate_filter_limit value was not
	picked up by the local delivery agent. This means the local
	delivery agent could run out of memory on large mailing
	list deliveries.

19980826

	Performance: mkmap/mkalias now run with the same speed as
	sendmail. VMailer now uses a 4096-entry cache with 1 Mbyte
	of memory for DB lookups.  File: util/dict_db.c.

19980902

	Robustness: the reject_unknown_hostname restriction for
	HELO/EHLO hostnames will now permit names that have an MX
	record instead of an A record.

19980903

	Feature: appending @$myorigin to an unqualified address is
	configurable with the boolean append_at_myorigin parameter
	(default: yes).

	Feature: appending .$mydomain to user@host is configurable
	with the boolean append_dot_mydomain parameter (default:
	yes).

	Feature: site!user is rewritten to user@site, under control
	of the boolean parameter swap_bangpath (default: yes).

	Feature: permit a naked IP address in HELO commands (i.e.
	an address without the enclosing [] as required by the
	RFC), by specifying "permit_naked_ip_address" as one of
	the restrictions in the "smtpd_helo_restrictions" config
	parameter.

19980904

	Code cleanup: when an SMTP client aborts a session after
	sending MAIL FROM, the cleanup service no longer warns that
	it is "skipping further client input". Files: cleanup/*.c.
	Thanks, Daniel Eisenbud, for prodding.

	Code cleanup: when an SMTP server disconnects in the middle
	of a session, don't try to send QUIT over the non-existing
	connection. Files: global/smtp_stream.c, smtp/smtp.c.
	Thanks, Daniel Eisenbud, for prodding, again.

	Code cleanup: the VMailer version number has moved from
	mail_params.h (which is included by lots of modules) to a
	separate file global/mail_version.h, so that a version
	change no longer results in massive recompilation.

	Bugfix: Errors-To was flagged as a sender address, so the
	address never was picked up.

	Code cleanup: support for Errors-To: headers completed.

19980905

	Feature: per-message exponential delivery backoff, by
	looking at the amount of time a message has been queued.
	Thanks, Mark Delany.

19980906

	Code cleanup: ripped out the per-host exponential backoff
	code. It was broken by 19980818. It was probably a bad idea
	anyway, because it required per-host, in-core, state kept
	by the queue manager.  All we do now is to keep state for
	$minimal_backoff_time seconds, but only for a limited number
	of hosts. Daniel Eisenbud spotted the problem.

	Lost feature: the SMTP session transcripts now show who
	said what. This feature was inadvertently dropped during
	development. Thanks, Daniel Eisenbud, for reminding.

	Documentation: the hard-coded rewriting process of the
	trivial-rewrite program is described in html/rewrite.html.

	Feature: the local delivery agent now does alias lookups
	before and after chopping off the recipient subaddress.
	This allows you to forward user-anything to another user,
	without losing the ability to redirect specific user-foo
	addresses.

19980909

	Feature: the smtp client now logs a warning that a server
	sends a greeting banner with the client's hostname, which
	could imply a mailer loop.

19980910

	Feature: separate canonical maps for sender and recipient
	address rewriting, so that you can rewrite an ugly sender
	address and still forward mail to that same ugly address
	without creating a mailer loop.  Files: cleanup_envelope.c,
	cleanup_message.c, cleanup_rewrite.c.

19980911

	Feature: virtual maps now support multiple addresses on
	the right-hand side. In the case of virtual domains this
	can eliminate the need for address expansion via local
	aliases, making virtual domains much easier to administer.
	This required that I moved the virtual table lookups from
	the queue manager to the cleanup service, so that every
	recipient has an on-disk status record.  Files: qmgr.c,
	qmgr_message.c, cleanup_envelope.c, cleanup_rewrite.c,
	cleanup_virtual.c.

	Feature: sendmail/mailq/newaliases pass on the -v flag to
	the program that they end up running, to make debugging a
	little easier.

19980914

	Bugfix: some anti-spam measures didn't recognize some
	addresses as local and would do too much work. File:
	smtpd_check.c.

	Bugfix: the smtp sender/recipient table lookup restriction
	destroyed global data, so that other restrictions could
	break. File: smtpd_check.c.

	Bugfix: after vmailer reload, single-threaded servers could
	exit before flushing unwritten data to the client. Example:
	cleanup would exit before acking success to pickup, so the
	message would be delivered twice. Bug reported by Brian
	Candler.

	Cleanup: removed spurious error output from vmailer-script.
	Reported by Brian Candler.

	Tolerance: ignore non-numeric SMTP server responses. There's
	lot of brain damage out there on the net.

19980915

	Feature: the smtp-sink benchmark tool now announces itself
	with a neutral name so that it can be run on the same
	machine as VMailer, without causing Postfix to complain
	about a mailer loop.

	Robustness: on LINUX, vmailer-script now does chattr +S to
	force synchronous directory updates. Fix developed with
	Chris Wedgwood.

19980916

	Bugfix: when transforming an RFC 822 address to external
	form, there is no need to quote " characters in comments.
	This didn't break anything, it just looked ugly.  File:
	global/tok822_parse.c

19980917

	Workaround: with deliveries to /file/name, use fsync() and
	ftruncate() only on regular files.  File: local/file.c

	Workaround: the plumbing code in master_spawn.c didn't
	check if it was dup2()/close()ing a descriptor to itself
	then closing it. Will have to redo the plumbing later.

19980918

	Workaround: on multiprocessor Solaris machines, one-second
	rollover appears to happen on different CPUs at slightly
	different times. Made the queue manager more tolerant for
	such things.  Problem reported by Daniel Eisenbud.

	Workaround: in preparation for deployment with a network-shared
	maildrop directory. make pickup more tolerant against clock
	drift between clients and servers.

19980921

	New vstream_popen() module that opens a two-way channel
	across a socketpair-based pipe. This module isn't being
	used yet; it is here only to complete the vstream code.

19980922

	Code cleanup: the xxx_server_main() interface for master
	child processes now uses a name-value argument list instead
	of an ugly and inflexible data structure.

	Bugfix: moved the test if a non-interactive process is run
	by hand, so that the "don't do this" error message can be
	printed to stderr before any significant processing.

	Bugfix: smtpd now can talk to unix-domain sockets without
	bailing out on a peer lookup problem. Files: smtpd/smtpd.c,
	util/peer_name.c.

	Safety: by default, the postmaster is no longer informed
	of protocol problems, policy violations or bounces.

	Safety: the SMTP server now sleeps before sending a [45]xx
	error response, in order to prevent clients from hammering
	the server with a connect/error/disconnect loop. Parameter:
	smtpd_error_sleep_time (default: 5).

	Feature: the logging facility is compile-time configurable
	(e.g., make makefiles "CCARGS=-DLOG_FACILITY=LOG_LOCAL1").

19980923

	Bugfix: changed virtual/canonical map search order from
	(user@domain, @domain, user) to (user@domain, user, @domain)
	so the search order is most specific to least specific.
	File: global/addr_map.c, lots of documentation.

	Bugfix: after the change of 19980910, cleanup_message
	extracted recipients from Reply-To: etc. headers.  Found
	by Lamont Jones.

19980925

	Bugfix: the change in virtual/canonical map search order
	broke @domain entries; they would never be looked up if
	the address matched $myorigin or $mydestinations. Found by
	Chip Christian who now regrets asking for the change.

	Bugfix: cleanup initialized an error mask incorrectly, so
	that it would keep writing to a file larger than the queue
	file size limit, and so it would treat the error as a
	recoverable one instead of sending a bounce. Thanks, Pieter
	Schoenmakers.

	Bugfix: the "queue file cleanup on fatal error" action was
	no longer enabled in the sendmail mail posting agent.

	Feature: the sendmail mail posting program now returns
	EX_UNAVAILABLE when the size of the input exceeds the queue
	file size limit. NB THIS CHANGE HAS BEEN WITHDRAWN.

19980926

	Code cleanup: the dotlock file locking routine is no longer
	derived from Eric Allman's 4.3BSD port of mail.local.

	Code cleanup: the retry strategy of the file locking routines
	dot_lockfile() and deliver_flock() is now configurable
	(deliver_flock_attempts, deliver_flock_delay, deliver_flock_stale).

	Code cleanup: the master.pid lock file is now created with
	symlink paranoia, and is properly locked so that PID rollover
	will not cause false matches.

	Bugfix: the vbuf_print() formatting engine did not know
	about the '+' format specifier.

	Cleanup: replaced unnecessary instances of stdio calls by
	vstream ones.

19980929-19981002

	Compatibility: added support for "sendmail -q". This required
	a change to the queue manager trigger protocol, and a code
	reorganization of the way queue scans were done. The queue
	manager socket now has become public.

19981002

	SMTPD now logs "lost connection after end-of-message"
	instead of "lost connection after DATA".

19981005

	More bullet proofing: timeouts on all triggers.

19981006

	Bugfix: make the number of cleanup processes unlimited, in
	order to avoid deadlock. The number of instances needed is
	one per smtp/pickup process, and an indeterminate number
	per local delivery agent. Thanks, Thanks, David Miller and
	Terry Lorrah for cleueing me in.

	Bugfix: "sendmail -t" extracted recipients weren't subjected
	to virtual mapping. Daniel Eisenbud strikes again.

19981007

	Compatibility: if the first input line ends in CRLF, the
	sendmail posting agent will treat all CRLF as LF. Otherwise,
	CRLF is left alone. This is a compromise between sendmail
	compatibility (all lines end in CRLF) and binary transparency
	(some, but not all, lines contain CRLF).

19981008

	Robustness: stop recursive virtual expansion when the
	left-hand side appears in its own expansion.

19981009

	Portability: trigger servers such as pickup and qmgr can
	now use either FIFOs or UNIX-domain sockets; hopefully at
	least one of them works properly. Trigger clients were
	already capable of using either form of local IPC.

19981011

	Feature: masquerading. Strip subdomains from domains listed
	in $masquerade_domains. Exception: envelope recipients are
	left alone, in order to not screw up routing.

19981015

	Code cleanup: moved the recipient duplicate filter from
	the user-level sendmail posting agent to the semi-resident
	cleanup service, so that the filter operates on the output
	from address canonicalization and of virtual expansion,
	instead of operating on their inputs.

19981016

	Bugfix: after kill()ing a bunch of child processes, wait()
	sometimes fails before all children have been reaped, and
	must be called again, or the master will SIGSEGV later.
	Problem reported by Scott Cotton.

	Workaround: don't log a complaint when an SMTP client goes
	away without sending QUIT.

19981018

	Workaround: Solaris 2.5 ioctl SIOCGIFCONF returns a hard
	error (EINVAL) when the result buffer is not large enough.
	This can happen on systems with many real or virtual
	interfaces. File: util/inet_addr_local.c. Problem reported
	by Scott Cotton.

	Workaround: the optional HELO/EHLO hostname syntax check
	now allows a single trailing dot.

	Workaround: with UNIX-domain sockets, LINUX connect() blocks
	until the server calls accept(). File: qmgr/qmgr_transport.c.
	Terry Lorrah and Scott Cotton provided the necessary
	evidence.

19981020

	Robustness: recursive canonical mapping terminates when
	the result stops changing.

	Code cleanup: reorganized the address rewriting and mapping
	code in the cleanup service, to make it easier to implement
	the previous enhancement.

19981022

	Code cleanup: more general queue scanning programming
	interface, in preparation for hashed queues. File:
	qmgr/qmgr_scan.c.

	Bugfix: a non-FIFO server with a process limit of 1 has a
	too short listen queue.  Until now this was not a problem
	because only FIFO servers had a process limit of 1, and
	FIFOs have no listen queue.  Fix: always configure a listen
	queue of proc_limit or more.  File: master/master_listen.c.

19981023

	Feature: by popular request, mail delay is logged when
	delivering, bouncing or deferring mail.

19981024

	Cleanup: double-bounce mail is now absorbed by the queue
	manager, instead of the local delivery agent, so that the
	mail system will not go mad when no local delivery agent
	is configured.

19981025

	Cleanup: moved the relocated table from the local delivery
	agent to the queue manager, so that the table can also be
	used for virtual addresses.

	Code reorg: in order for the queue manager to absorb
	recipients, the queue file has to stay open until all
	recipients have been assigned to a destination queue.

19981026

	vmlogger command, so that vmailer-script logging becomes
	consistent with the rest of the VMailer system.

	Code reorg: logger interface now can handle multiple output
	handlers (e.g. syslog and stderr stream).

	Bugfix: a first line starting with whitespace is no longer
	treated as an extension of our own Received: header. Files:
	smtpd/smtpd.c, pickup/pickup.c.

19981027

	Bugfix: the bang-path swapping code went into a loop on an
	address consisting of just a single !. Eilon Gishri had
	the privilege of finding this one.

	Workaround: the non-blocking UNIX-domain socket connect is
	now enabled only on systems that need it. It may cause
	kernel trouble on Solaris 2.x.

	Bugfix: the resolver didn't implement bangpath swapping,
	so that mail for site!user@mydomain would be delivered to
	a local user named "site!user".

19981028

	Cleanup: a VSTREAM can now use different file descriptors
	for reading and writing. This was necessary to prevent
	"sendmail -bs" and showq from writing to stdin. Eilon Gishri
	observed the problem.

19981029

	The RFC 822 address manipulation routines no longer give
	special attention to 8-bit data. Files: global/tok822_parse.c,
	global/quote_822_local.c.

	Bugfix: host:port and other non-domain stuff is no longer
	allowed in mail addresses.  File: qmgr/qmgr_message.c.

	Workaround: LINUX accept() wakes up before the three-way
	handshake is complete, so it can fail with ECONNRESET.
	Files: master/single_server.c, master/multi_server.c.

	Feature: when delivering to user+foo, try ~user/.forward+foo
	before trying ~user/.forward.

	Bugfix: smtpd in "sendmail -bs" (stand-alone) mode didn't
	clean up when terminated by a signal.

	Bugfix: smtpd in "sendmail -bs" (stand-alone) mode should
	not try to enforce spam controls because it cannot access
	the address rewriting machinery.

	Cleanup: the percent hack (user%domain -> user@domain) is
	now configurable (allow_percent_hack, default: yes).

	Bugfix: daemons in -S (stand-alone) mode didn't change
	directory to the queue. This was no problem with daemons
	run by the sendmail compatibility program.

19981030

	Feature: when virtual/canonical/relocated lookup fails for
	an address that contains the optional recipient delimiter
	(e.g., user+foo@domain), the search is done again with the
	unextended address (e.g., user@domain). File: global/addr_find.c.

	Code reorg: the address searching is now implemented by a
	separate module global/addr_find.c, so that the same code
	can be used for both (non-mapping) relocated table lookups
	and for canonical and virtual mapping. The actual mapping
	is still done in the global/addr_map.c module.

	Robustness: the SMTP client now skips hosts that don't send
	greeting banner text. File: smtp/smtp_connect.c

	Feature: preliminary support to disable delivered-to. This
	is desirable for mailing list managers that don't want to
	advertise internal aliases.

	Generic support: when the recipient_feature_delimiter
	configuration parameter is set, the local delivery agent
	uses it to split the recipient localpart into fields. Any
	field that has a known name such as "nodelivered" enables
	the corresponding delivery feature.

19981031

	Code reorg: address splitting on recipient delimiter is
	now centralized in global/split_addr.c, which knows about
	all reserved names that should never be split.

	Robustness: when a request for an internal service cannot
	be satisfied because the master has terminated, terminate
	instead of trying to reach the service every 30 seconds.

	Safety: the local delivery agent now runs as vmailer most
	of the time, just like pickup and pipe. Files: local/local.c,
	local/mailbox.c

19981101

	Compatibility: the tokenizer for alias/forward/etc.
	expansion now updates an optional counter with the number
	of destinations found; If no destinations is found in a
	.forward file, deliver to the mailbox instead. Thanks,
	Daniel Eisenbud, for showing the way to go.

	Robustness: the pickup daemon should always include a
	posting-time record, even when the sendmail posting agent
	didn't. However, just like before, user-provided posting
	times will be ignored. Ollivier Robert found this one.

	Robustness: duplicate entries in aliases or maps now cause
	a warning instead of a fatal error (and an incomplete file).

	Robustness: mkmap now prints a warning when an entry is in
	"key: value" format, which is the format expected for alias
	databases, not for maps.

	Portability: on LINUX, prepend "+" to the getopt() options
	string so that getopt() will stop at the first non-option
	argument. Suggestion by Marco d'Itri.

19981103

	Cleaned up the set_eugid() and open_as() implementations,
	and added stat_as() and fstat_as() so that the local delivery
	agent would look up include files and .forward files with
	the right privileges.

19981104

	Bugfix: the :include: routine now stat()s/open()s files
	included by root-owned aliases as root, not as nobody.

	Bugfix: the master crashed when a service with wakeup timer
	was disabled or renamed.  Fix: eliminate some pathological
	coupling between process management and wakeup management.

	Feature: partial implementation of ETRN (causes a full
	deferred queue scan). Thanks Lamont Jones for reminding me
	that things can be useful already before they are perfect.

	Cleanup: simplified the SMTPD tokenizer.

	Bugfix: sendmail -bs didn't properly notify the mail system
	of new mail.

	Compatibility: the MAIL FROM and RCPT TO commands now accept
	the most common address forms without enclosing <>. The <>
	is still needed for addresses that contain a "string", an
	[address], or a colon (:).

19981105

	Bugfix: "master -t" would claim that the master runs when
	in fact the pid directory does not exist, causing trouble
	with first time startup (reported by several).

	Portability: added a sane_accept() module that maps all
	beneficial accept() error results to EAGAIN. According to
	private communication with Alan Cox, Linux 2.0.x accept()
	can return a variety of error conditions, so we play safe
	and allow for any error that may happen because SYN+ACK
	could not be sent.

	Portability: NETBSD1 uses dotlock files (Perry Metzger).

	Bugfix: the local delivery agent did not canonicalize
	owner-foo sender addresses, so that local users would see
	owner-foo instead of owner-foo@$myorigin (Perry Metzger).

	OPENSTEP4 support, similar to NEXTSTEP3 (Gerben Wierda).

19981106

	Portability: the master startup would take a long time on
	AIX because AIX has a very large per-process open file
	limit.  Fix is to check the status of only the first couple
	hundred file descriptors instead. File: master/master.c.

	Bugfix: mail to user@[net.work.addr.ess] was broken because
	of a reversed test. File: qmgr/qmgr_message.c.

19981107

	Compatibility: don't clobber the envelope sender address
	when an alias has no owner-foo alias (problem diagnosed by
	Christophe Kalt).

	Bugfix: mail to local users in include files would be
	delivered directly if the alias didn't have an owner-foo
	alias, and if the alias database and include file were
	owned by root.

	Feature: with user+foo addresses, any +foo address extension
	that is not explicitly matched in canonical, virtual or
	alias databases is propagated to the table lookup result.

19981108

	Bugfix: minor memory leak in the user+foo table lookup
	code.

	Configurability: specify virtual.domain in the virtual map,
	and mail for unknown@virtual.domain will bounce automatically.
	The $relay_domains default value now includes $virtual_maps,
	so the SMTP server will accept mail for the domain. Marco
	d'Itri put me on the right track.

	Configurability: The mydestinations configuration parameter
	now accepts /file/name expressions and type:name lookup
	tables.

	Code cleanup: in order to make the previous two enhancements
	possible, revised the string/host/address matching engine
	so it can handle any mixture of strings, /file/name patterns
	and type:name lookup tables. Files: util/match_{list,ops}.c,
	global/{domain,namadr,string}_list.c.

19981110

	Code cleanup: replaced remaining isxxx() calls by ISXXX().

19981111

	Bugfix: the "bounce unknown virtual user" code was in the
	wrong place. Problem tackled with help of Chip Christian.

	Portability: reportedly, Solaris 2.5.1 can hang waiting
	for a UNIX-domain connection to be accepted, so it gets
	the same workaround that was designed for LINUX. Problem
	reported by Scott Cotton.

19981112

	Management: "vmailer stop" now allows delivery agents to
	finish what they are doing, like "vmailer reload".

	Management; "vmailer abort" causes immediate termination.

	Workaround: zombie processes pile up with HP-UX. Reason:
	select() does not return upon SIGCHLD when SA_RESTART is
	specified to sigaction(). Workaround: shorten the select()
	timer to 10 seconds, #ifdef BRAINDEAD_SELECT_RESTARTS.
	Thanks, Lamont Jones.

19981117

	Rename: VMailer is now Postfix. Sigh.

19981118

	Cleanup: generalized the safe_open() routine so that it is
	no longer limited to mailbox files, lock files, etc.

	Bugfix (found during code review): vstream*printf() could
	run off the end of a stream buffer after an I/O error,
	because vbuf_print() ignored the result from VBUF_SPACE().

	Bugfix (found during code review): resolve_local() could
	clobber its argument, but the docs didn't say so.

19981121

	Cleanup: the is_header() routine now allows 8-bit data in
	header labels.

19981123

	Bugfix (found during code review): the mail_queue_enter()
	path argument wasn't optional.  File: global/mail_queue.c

19981124

	Cleanup: eliminated redundant tests for a zero result from
	vstream_fdopen(). Unlike the stdio fdopen() routine, the
	vstream_fdopen() routine either succeeds or never returns.

	Bugfix: the queue manager now looks at the clock before
	examining a file time stamp, to avoid spurious complaints
	about time warps on busy machines. File:  qmgr/qmgr_active.c.

19981125

	Compatibility: allow trailing dot at the end of user@domain.
	Address canonicalization now strips it off. Issue brought
	forward by Eilon Gishri. File: trivial-rewrite/rewrite.c.

	Robustness: changed DNS lookup order of MAIL FROM etc.
	domains from MX then A to A then MX, just in case the MX
	lookup fails with a server error.

	Renamed vmcat, vmlock, vmlogger, vmtrigger to postcat,
	postlock, postlog, postkick. Also renamed mkmap and mkalias
	to postmap and postalias.

19981126

	Workaround: Lamont Jones found a way for HP-UX to terminate
	select() after SIGCHLD. The code is #ifdef USE_SIG_RETURN.
	Files:  util/sys_defs.h, master/master_sig.c.

	Bugfix: the Delivered-To: loop detection code had stopped
	working, when long ago the is_header() routine was changed.
	File: local/delivered.c.

19981128

	Bugfix: postcat opened queue files read-write, where only
	read access was needed. File: postcat/postcat.c.

19981129

	Safety: added a sleep(1) to all fatal and panic exits.
	File: util/msg.c.

19981201

	Robustness: postcat now insists that a file starts with a
	time record.

	Consistency: added "-c config_dir" command-line options
	where appropriate.

19981202

	Man pages, on-line version.

19981203

	Man pages, html version; overview documentation.

19981206

	Sendmail silently accepted the unsupported -qRsite and
	-qSsite options.  It now prints an error message and
	terminates.

	Separated the contributed tree from the IBM code; moved
	the LDAP and NEXTSTEP/OPENSTEP code to the contributed
	source tree because obviously I didn't write it.

19981206-9

	Had to write a postconf configuration utility in order to
	reliably find out about all configuration parameters and
	their defaults.

	Documentation bugfixes by Matt Shibla, Scott Drassinower,
	Greg A. Woods.

19981209

	On machines with short hostnames, postconf -d cored while
	reporting a fatal error. It should not report that error
	in the first place. Thanks, Eilon Gishri.

	Changed the FAQ entry about rejecting mail for *.my.domain
	on a firewall. Chip Christian was right, I was wrong.

19981214

	Portability: with GNU getopt, optind is not initially 1,
	breaking an assumption in sendmail/sendmail.c. Liviu Daia.

	Annoyance: on non-networked systems, don't warn that only
	one network interface was found. File:  global/inet_addr_local.c.
	Reported by several.

	Bugfix: on non-networked systems, the smtp client assumed
	that it was running in virtual host mode, and would bind
	to the loopback interface. File smtp/smtp_connect.c.  Liviu
	Daia, again.

19981220

	Robustness: when looking up an A or MX record, do not give
	up when the A query fails because of a server error.  File
	dns/dns_lookup.c. Reported by Scott Drassinower.

19981221

	Bugfix: "bounce mail for non-existent virtual user" didn't
	work when a non-default relay host was configured in main.cf
	or in the transport table. File: qmgr/qmgr_message.c.

	Bugfix: the maildrop directory should not be world-readable.
	Files: conf/postfix-script, showq/showq.c.

	Documentation: fixed several omissions and errors.

	Documentation: removed references to the broken recipient
	feature delimiter configuration parameter.

	Bugfix: write mailbox file as the recipient, so that file
	quota work as expected.

	Bugfix: pickup would die when it tried to remove a non-file
	in the maildrop directory (Jeff Wolfe).

19981222

	Sendmail no longer logs the queue ID when it is unable to
	notify the pickup daemon. This is a late addition to the
	"unreadable maildrop queue" patch.

	user.lock files are now created as root, so that postfix
	needs no group directory write permission.

19981224

	Security: allow queue file link counts > 1, to avoid
	non-delivery of maildrop files with links to a non-maildrop
	directory.  Files:  global/mail_open_ok.c, and anything
	that calls this code (qmgr, pickup, showq). If multiple
	hard links are a problem, see the set-gid "postdrop" utility
	below.

19981225

	Robustness: the queue manager no longer aborts when a queue
	file suddenly disappears (e.g. because the file was removed
	by hand).

	Feature: when a writable maildrop directory is a problem,
	sites can make the new "postdrop" utility set-gid. This
	command is never used when the maildrop directory is
	world-writable.

	Robustness: make the queue file creation routine more
	resistant against denial of service race attack. File:
	global/mail_queue.c

19981226

	New suid_priv module to enable/disable privileges in a
	set-uid/gid program. In the end I decided to not use it.

19981228

	Robustness: make the pickup daemon more resistant against
	non-file race attack.

	Cleanup: generic mail_stream.c interface for writing queue
	file streams to files, daemons or commands. This simplifies
	the code in smtpd and in sendmail that must be able to pipe
	mail through the postdrop command. The cleanup daemon has
	been modified to use the same interface. Result: less code.

	Feature: smtpd now logs the only recipient in Received:
	headers.

	Feature: separate command and daemon directories. Both
	default to $program_directory. Install conf/postfix-script
	if you want to use this feature.

19981230

	Patch to avoid conflict with non-writable top-level Makefile
	(Lamont Jones).

19981231

	Portability: port to UnixWare 7 by Ronald Joe Record, SCO.

19990104

	Bugfix: fencepost (Jon Ribbens, Oaktree Internet Solutions
	Ltd.) Files: quote_82[12]_local.c.

	Bugfix: wrong default for relay_domains (Juergen Kirschbaum,
	Bayerische Landesbank). File: mail_params.h.

	Bugfix: changed 5xx response for "too may recipients" to
	4xx. File: smtpd.c.

19990106

	Feature: defer_transports specifies the names of transports
	that should be used only when "sendmail -q" (or equivalent)
	is issued. For example, "defer_transports = smtp" is useful
	for sites that are disconnected most of the time. File:
	qmgr_message.c.

19990107

	Feature: local_command_shell specifies a non-default shell
	for delivery to command by the local delivery agent. For
	example, "local_command_shell = /some/where/smrsh -c"
	restricts what may appear in "|command" destinations.
	File: global/pipe_command.c.

19990112-16

	Feature: SMTP command pipelining support based on an initial
	version by Jon Ribbens, Oaktree Internet Solutions Ltd.
	This one took several days of massaging before I felt
	comfortable about it. Files: smtp.c, smtp_proto.c.

	Bugfix: the SMTP server would flush responses one-by-one,
	which caused suboptimal performance with pipelined clients.
	The vstream routines now flush the write buffer when the
	read() routine is called, instead of flushing when the
	application changes from writing to reading. Delayed flush
	prevents the SMTP server from flushing responses one-by-one
	and thus triggering Nagle's algorithm. File: util/vstream.c.

19990117

	Bugfixes and enhancements to the smtpstone tools by Drew
	Derbyshire, Kendra Electronic Wonderworks: send helo command,
	send message headers, format the message content to lines
	< 80, work around NT stacks, make "." recognition more
	robust. Files: smtp-source.c, smtp-sink.c.

	Strategy: look at the deferred queue only when the incoming
	queue is empty; limit the number of recipients read from
	a queue file depending on the number of recipients already
	in core. Files: qmgr.c, qmgr_message.c.

	Feature: postponed anti-UCE restrictions. The decision to
	reject junk mail on the basis of the client name/address,
	HELO hostname or sender address can now be postponed until
	the RCPT TO command (or HELO or MAIL FROM if you like).
	File: smtpd_check.c.

19990118

	Feature: incremental updates of alias databases and of
	other lookup tables. Both postalias and postmap now take
	a -i option for incremental updates from standard input.
	Files: global/mkmap_*.c, post{map,alias}/post{map,alias}.c.

	Compatibility: newaliases can now update multiple alias
	databases: list them in the "alias_database" parameter in
	main.cf. By the same token, postalias can now update multiple
	maps in one command. Files:  post{map,alias}/post{map,alias}.c

	Feature: mail to <> is now sent to the address specified
	with the "empty_address_recipient" configuration parameter
	which defaults to MAILER-DAEMON (idea by Lamont Jones,
	Hewlett-Packard). File: cleanup/cleanup_envelope.c.

	Compatibility: the transport table now uses .domain.name
	to match subdomains, just like sendmail mailer tables (patch
	by Lamont Jones, Hewlett-Packard).

	Feature: mailq now ends with a total queue size summary
	(Eilon Gishri, Israel Inter University Computation Center).

19990119

	Feature: address masquerade exceptions for user names listed
	in the "masquerade_exceptions" configuration parameter.
	File: cleanup/cleanup_masquerade.c.

	Feature: qmail-style maildir support, based on initial code
	by Kevin W. Brown, Quantum Internet Services Inc.

	Workaround: Solaris 2.something connect() fails with
	ECONNREFUSED when the system is busy (Chris Cappuccio,
	Empire Net). File: global/mail_connect.c.

	Feature: the cleanup service now adds a Return-Path: header
	when none is present. This header is needed for some mail
	delivery programs (see below). File: cleanup_message.c.

	Feature: the pipe mailer now supports $user, $extension
	and $mailbox macros in command-line expansions. This, plus
	the Return-Path: header (see above), should be sufficient
	to support cyrus IMAP out of the box. Based on  initial
	code by Joerg Henne, Cogito Informationssysteme GMBH.
	File: pipe/pipe.c.

	Bugfix: with address extensions enabled, canonical and
	virtual lookups now are done in the proper order:
	user+foo@domain, user@domain, user+foo, user, @domain.
	File: global/mail_addr_find.c.

19990119

	Feature: the local mailer now prepends a Received: message
	header with the queue ID to forwarded mail, in order to
	make message tracing easier.  File: local/forward.c.

	Cleanup: after "postfix reload", no more broken pipe
	complaints from resolve/rewrite clients.

19990121

	Feature: pickup (again) logs uid and sender address.  On
	repeated request by Scott Cotton, Internet Consultants
	Group, Inc.

	Portability: doze() function for systems without usleep().

	Cleanup: clients are now consistently logged as host[address].

19990122

	Maildir support changed: specify "home_mailbox = Maildir/".
	The magic is the trailing /. Suggested by Daniel Eisenbud,
	University of California at Berkeley.

	Maildir support from aliases, :include: and .forward files.
	Specify /file/name/ - the trailing / is required. Suggested