- allow build on FreeBSD 11 with openssl from ports [1] - remove TLS_USES = ssl, since USES = ssl already defined PR: [1] 248364 Reported by: Gerard Seiber and Michael Grimm016b6df4fa
Postfix -- memory corruption vulnerabilityentered 2011-05-09
Port details
mail/postfix-current 3.12.20260925_3,6
Experimental Postfix version
Port info
- Maintainer
- otis@FreeBSD.org
- Packages
- latest: postfix-current 3.12.20260925_3,6, postfix-current-ldap 3.12.20260925_3,6, postfix-current-mongo 3.12.20260925_3,6, postfix-current-mysql 3.12.20260925_3,6, postfix-current-pgsql 3.12.20260925_3,6, postfix-current-sasl 3.12.20260925_3,6, postfix-current-sqlite 3.12.20260925_3,6
- Upstream
- up to date
- Last update
- to 3.12.20260925_3,6 · 85ba298b7e
- Quarterly
- 2026Q4: postfix-current 3.12.20260925_2,6, postfix-current-ldap 3.12.20260925_2,6, postfix-current-mongo 3.12.20260925_2,6, postfix-current-mysql 3.12.20260925_2,6, postfix-current-pgsql 3.12.20260925_2,6, postfix-current-sasl 3.12.20260925_2,6, postfix-current-sqlite 3.12.20260925_2,6 · last MFH 11116f8834
- Formerly
- mail/postfix-current-sasl until 2021-10-28
- WWW
- https://www.postfix.org/
- Links
- cgit · VuXML · Report wrong data
Install
- Package
# pkg install postfix-current# pkg install postfix-current-ldap# pkg install postfix-current-mongo# pkg install postfix-current-mysql# pkg install postfix-current-pgsql# pkg install postfix-current-sasl# pkg install postfix-current-sqliteinstalls postfix-current 3.12.20260925_3,6, postfix-current-ldap 3.12.20260925_3,6, postfix-current-mongo 3.12.20260925_3,6, postfix-current-mysql 3.12.20260925_3,6, postfix-current-pgsql 3.12.20260925_3,6, postfix-current-sasl 3.12.20260925_3,6, postfix-current-sqlite 3.12.20260925_3,6 fromlatest; fromquarterly(2026Q4) postfix-current 3.12.20260925_2,6, postfix-current-ldap 3.12.20260925_2,6, postfix-current-mongo 3.12.20260925_2,6, postfix-current-mysql 3.12.20260925_2,6, postfix-current-pgsql 3.12.20260925_2,6, postfix-current-sasl 3.12.20260925_2,6, postfix-current-sqlite 3.12.20260925_2,6- Port
# cd /usr/ports/mail/postfix-current && make install clean# make -C /usr/ports/mail/postfix-current config # change options first
- Size
- 1.8 MiB download · 8.5 MiB installed
- Depends on
- databases/lmdb0 0.9.36_1, databases/tinycdb 0.81, devel/icu 76.1,1, devel/pcre2 10.49, mail/libtlsrpt 0.5.1
- License
- EPL and IPL10
- Creates
- user
postfix, groupmail,maildrop,postfix - Options
- 9 of 22 on in the package: BLOCKLISTD CDB DOCS EAI LMDB LMDB0 PCRE2 TLS TLSRPT
Show the 13 options that are off
BDB INST_BASE LDAP LMDB1 MONGO MYSQL NIS PGSQL SASL SASLKMIT SASLKRB5 SQLITE TEST - pkg-message
Shown after installing
To use postfix instead of sendmail: - clear sendmail queue and stop the sendmail daemons Run the following commands to enable postfix during startup: - sysrc postfix_enable="YES" - sysrc sendmail_enable="NONE" If postfix is *not* already activated in /usr/local/etc/mail/mailer.conf - mv /usr/local/etc/mail/mailer.conf /usr/local/etc/mail/mailer.conf.old - install -d /usr/local/etc/mail - install -m 0644 /usr/local/share/postfix/mailer.conf.postfix /usr/local/etc/mail/mailer.conf Disable sendmail(8) specific tasks, add the following lines to /etc/periodic.conf(.local): daily_clean_hoststat_enable="NO" daily_status_mail_rejects_enable="NO" daily_status_include_submit_mailq="NO" daily_submit_queuerun="NO" If you are using SASL, you need to make sure that postfix has access to read the sasldb file. This is accomplished by adding postfix to group mail and making the /usr/local/etc/sasldb* file(s) readable by group mail (this should be the default for new installs).
Shown after upgrading
If you are upgrading from prior postfix version, please see the README files for recommended changes to your configuration and additional http://www.postfix.org/COMPATIBILITY_README.html Incompatible change with snapshot 20200920 ========================================== Internal protocols have changed. You need to "postfix stop" before updating, or before backing out to an earlier release, otherwise long-running daemons (pickup, qmgr, verify, tlsproxy, postscreen) may fail to communicate with the rest of Postfix (warnings, timeouts). The purpose of this change is to produce better error messages, for example, when someone configures the discard daemon as a bounce service in master.cf, or vice versa. This change will break third-party code that implements a Postfix-internal protocol such as qpsmtpd. Programs that depend on Postfix internal details are not supported.
Shown after removing
If you remove postfix permanent, adjust / remove the the following file: - /usr/local/etc/mail/mailer.conf
- Note
- Size, dependencies, options and messages are those of postfix-current.
Packages by version and architecture
latest
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 3.12.20260925_3,6 | 3.12.20260925_2,6 | – |
| FreeBSD 15 | 3.12.20260925_3,6 | 3.12.20260925_2,6 | – |
| FreeBSD 14 | 3.12.20260925_3,6 | 3.12.20260925_2,6 | 3.12.20260925_3,6 |
quarterly (2026Q4)
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 3.12.20260925_2,6 | 3.12.20260925_2,6 | – |
| FreeBSD 14 | 3.12.20260925_2,6 | 3.12.20260925,6 | 3.12.20260925_2,6 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by
pkg audit for the packaged version 3.12.20260925_3,6.Fixed (2)
Show 2 fixed
VuXML entries whose affected range the packaged version has left.
postfix -- plaintext command injection with SMTP over TLSentered 2011-03-19
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (588)
- update to 3.6-20200725631f9bfa82
- update to 3.6-20200720 Incompatible change with snapshot 20200705 ========================================== The minimum OpenSSL version is 1.1.1, which will reach the end of life by 2023-09-11. The default digest has changed from md5 to sha256 (Postfix 3.6 with compatibility_level >= 3). With a lower compatibility_level setting, Postfix defaults to using md5, and logs a warning when a Postfix configuration specifies no explicit digest type. Export-grade Diffie-Hellman key exchange is no longer supported, and the tlsproxy_tls_dh512_param_file parameter is ignored,4e5db8144d
Fix easy typo.
Reported by: V_PauAmma_V
Approved by: portmgr ("obvious fix")cf9dbb49d8- update to 3.6-20200627f8431156ec
- update to 3.6-20200620f3a421989a
- update to 3.6-202006104537aa0957
- update to 3.6-202005318801cbfd4c
- update to 3.6-20200523ae8c55f497
- update to 3.6-202005151e47c096cc
- update to 3.6-20200511bef445341a
- update to 3.6-202005094260e4e6ba
- update to 3.6-202005042626bbbfef
- update to 3.6-2020041918675bd97f
devel/icu: update to 67.1 Changes: http://site.icu-project.org/download/67 ABI: https://abi-laboratory.pro/tracker/timeline/icu4c/ Reported by: GitHub (watch releases)ffb8eb82e5
- update to 3.6-20200416dbb9bfe909
- update to 3.6-20200316346c49b070
- update to 3.5.0-RC2 - bump PORTEPOCH - remove deprecated ports from CONFLICTS_INSTALL - add BLACKLISTD to OPTIONS_DEFAULT - MYSQL_USES s/=/?=/ to allow testbuild without defining XX MYSQL dedicated make.conf's in poudriere - add postlogd to STRIP_LIBEXEC8b0d952f89
devel/icu: update to 66.1 Changes: http://site.icu-project.org/download/66 ABI: https://abi-laboratory.pro/tracker/timeline/icu4c/f821cdc347
- update to 3.5-20200126fe9fe811aa
- update to 3.5-20200112383aaf4a6e
- update to 3.5-20200105328c69bf23
- update to 3.5-20191214f392db6c3b
- update to 3.5-2019110999237c85c2
- update to 3.5-20191019526e857f35
- update to 3.5-20191013f3bcae7a40
Drop the ipv6 virtual category for m* category as it is not relevant anymore0be2ce42f1
devel/icu: update to 65.1 Changes: http://site.icu-project.org/download/65 ABI: https://abi-laboratory.pro/tracker/timeline/icu4c/4bbb4133b2
- update to 3.5-20190922699946ff7d
- update to 3.5-201907244795c67f24
- update to 3.5-20190621 - convert pkg-message to UCLacc3c8442f
- update to 3.5-20190615 Incompatibility with snapshot 20190615 ==================================== The Postfix TLS library by default no longer waits after sending a TLS 'close' notification. This should be safe with TLSv1.2 and later. Specify "tls_fast_shutdown_enable = no" to enable historical Postfix behavior. Major changes with snapshot 20190615 ==================================== After sending a TLS 'close' notification, the Postfix library by default no longer waits for the TLS peer to respond. According to RFC 2246 (TLSv1.2) section 7.2.1, "It is not required for the initiator of the close to wait for the responding close_notify alert before closing the read side of the connection." The SMTP+LMTP delivery agent can now prepend Delivered-To, X-Original-To and Return-Path headers, just like the pipe(8) delivery agent. This uses the same "flags=DOR" command-line flags in master.cf. See the smtp(8) manpage for details. This obsoletes the "lmtp_assume_final = yes" setting, and replaces it with "flags=...X...", for consistency with pipe(8).2243081405
- update to 3.5-20190518d9e684df4d
- update to 3.5-20190517
20190516
Initial search order support for check_ccert_access. The
default behavior is backwards-compatible. This is work in
progress; see the RELEASE_NOTES for examples.
20190517
Bugfix: postconf mis-parsed text starting with "{" such as
"check_ccert_access { inline:{a=b} { search_order=c,d } }".
Fixed by adding another level of recursion.65544fcc00- update to 3.5-20190427 Note: ---------------------------------------------------------------------- Incompatibility with snapshot 20190427 ====================================== Postfix now normalizes IP addresses received with XCLIENT, XFORWARD, or with the HaProxy protocol, for consistency with direct connections to Postfix. This may change the appearance of logging, and the way that check_client_access will match subnets of an IPv6 address. Changelog: ---------------------------------------------------------------------- 20190331 Documentation: tlsext_padding is not a tls_ssl_options feature. File: proto/postconf.proto. 20190401 Portability: to avoid a compile-time error on Solaris, added "#undef sun" to util/unix_dgram_connect.c. 20190403 Bugfix (introduced: Postfix 2.3): a censoring filter broke multiline Milter responses for header/body events. Problem report by Andreas Thienemann. Files: util/printable.c, util/stringops.h, smtpd/smtpd.c. Bugfix (introduced: Postfix 3.3): "smtp_mx_address_limit = 0" no longer meant 'unlimited'. Problem report by Luc Pardon. File: smtp/smtp_addr.c. 20190427 Cleanup: normalize the IP address string forms received with XCLIENT, XFORWARD, and HaProxy, for consistency with address information for direct connections to Postfix, and add unit tests. This casefolds and removes redundant nulls from the string representation of an IPv6 address, normalizes the "IPv6:" address prefix of RFC 2821 IPv6 address forms, and converts IPv4 address octets with leading zeros (octal form) into decimal form. Files: global/haproxy.c, global/normalize_mailhost_addr.[hc], smtpd/smtpd.c. Incompatibility: this may change the appearance of logging, and the way that check_client_access will match subnets of an IPv6 address.12c556316d
- update to 3.5-20190330 - adopt libressl patches from OpenBSD5e14016976
- update to 3.4-201901066629c844a3
devel/icu: update to 64.1 Changes: http://site.icu-project.org/download/64 ABI: https://abi-laboratory.pro/tracker/timeline/icu4c/ PR: 236325 Exp-run by: antoine Differential Revision: https://reviews.freebsd.org/D19479480c577baa
- update to 3.4-2018120282a8e77426
- update to 3.4-20181130d775b3dfcf
- add ability to overwrite OPTIONS_DEFAULT for slave ports (s/=/?=/) PR: 233608 Submitted by: HEO SeonMeyong666127294e
- fix build with libressl 2.8.2 PR: 233517 Submitted by: Andrej Eberte7c310a8a0
- update to 3.4-2018112323a4252f8f
- update to 3.4-20181119fd7eee9167
- update to 3.4-20181118a1855b7c21
- update to 2018111705ac9ce1f6
- update to 3.4-201811134432fb551b
- update to 20181105 20181014 Cleanup: figured out why vstring_get() did not return VSTREAM_EOF in APPEND mode. 20181104 Multiple 'bit rot' fixes for OpenSSL API changes, including support to disable TLSv1.3, to avoid issuing multiple session tickets, and to allow OpenSSL >= 1.1.0 run-time micro version bumps without complaining about library version mismatches. 20181105 Feature: "postmap -F" reads a source file with (key, filename) entries, and creates database records with (key, base64-encoded filecontent). This feature will be used for SNI lookup table support, where each key will be a domainname, and each value will contain a sequence of (private key, certificate hierarchy) for that domainname. The same 'value is filename' behavior is implemented in cidr:, inline:, pcre:, randmap:, regexp:, and static: maps if the application sets the flag DICT_FLAG_RHS_IS_FILE. In the forseeable future, this willb5efc5d33e
Remove compatibility code for FreeBSD < 11.2 from all ports. Simplify some ports where DragonFlyBSD no longer needs to be special-cased. Submitted by: rene Reviewed by: bapt, jbeich Differential Revision: https://reviews.freebsd.org/D177248a502cb2d4
devel/icu: update to 63.1 Changes: http://site.icu-project.org/download/63 ABI: https://abi-laboratory.pro/tracker/timeline/icu4c/ PR: 232300 Exp-run by: antoine91f9922c6f