Prereq: "2.9.4"
diff -cr --new-file /var/tmp/postfix-2.9.4/src/global/mail_version.h ./src/global/mail_version.h
*** /var/tmp/postfix-2.9.4/src/global/mail_version.h	Wed Aug  1 17:48:05 2012
--- ./src/global/mail_version.h	Wed Dec 12 19:38:59 2012
***************
*** 20,27 ****
    * Patches change both the patchlevel and the release date. Snapshots have no
    * patchlevel; they change the release date only.
    */
! #define MAIL_RELEASE_DATE	"20120801"
! #define MAIL_VERSION_NUMBER	"2.9.4"
  
  #ifdef SNAPSHOT
  # define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
--- 20,27 ----
    * Patches change both the patchlevel and the release date. Snapshots have no
    * patchlevel; they change the release date only.
    */
! #define MAIL_RELEASE_DATE	"20121213"
! #define MAIL_VERSION_NUMBER	"2.9.5"
  
  #ifdef SNAPSHOT
  # define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
diff -cr --new-file /var/tmp/postfix-2.9.4/HISTORY ./HISTORY
*** /var/tmp/postfix-2.9.4/HISTORY	Wed Aug  1 17:33:29 2012
--- ./HISTORY	Mon Dec 10 09:03:51 2012
***************
*** 17718,17720 ****
--- 17718,17758 ----
  
  	Bugfix (introduced: 20000314): AUTH is not allowed after
  	MAIL. Timo Sirainen.  File: smtpd/smtpd_sasl_proto.c.
+ 
+ 20121003
+ 
+ 	Bugfix: the postscreen_access_list feature was case-sensitive
+ 	in the first character of permit, reject, etc. Reported by
+ 	Francis Picabia. File: global/server_acl.c.
+ 
+ 20121010
+ 
+ 	Bugfix (introduced: Postfix 2.5): memory leak in program
+ 	initialization. Reported by Coverity. File: tls/tls_misc.c.
+ 
+ 	Bugfix (introduced: Postfix 2.3): memory leak in the unused
+ 	oqmgr program. Reported by Coverity. File: oqmgr/qmgr_message.c.
+ 
+ 20121013
+ 
+ 	Cleanup: to compute the LDAP connection cache lookup key,
+ 	join the numeric fields with null, just like string fields.
+ 	Viktor Dukhovni. File: global/dict_ldap.c.
+ 
+ 20121029
+ 
+ 	Workaround: strip datalink suffix from IPv6 addresses
+ 	returned by the system getaddrinfo() routine.  Such suffixes
+ 	mess up the default mynetworks value, host name/address
+ 	verification and possibly more. This change obsoletes the
+ 	20101108 change that removes datalink suffixes in the SMTP
+ 	and QMQP servers, but we leave that code alone.  File:
+ 	util/myaddrinfo.c.
+ 
+ 20121210
+ 
+ 	Bugfix (introduced: Postfix 2.9) nesting count error while
+ 	stripping the optional [] around a DNS[BW]L address pattern.
+ 	This part of the code is not documented and had escaped
+ 	testing.  Files: util/ip_match.c, util/ip_match.in,
+ 	util/ip_match.ref.
diff -cr --new-file /var/tmp/postfix-2.9.4/makedefs ./makedefs
*** /var/tmp/postfix-2.9.4/makedefs	Tue Jan 17 20:19:48 2012
--- ./makedefs	Thu Nov 29 18:53:34 2012
***************
*** 153,158 ****
--- 153,160 ----
  		;;
    FreeBSD.8*)	SYSTYPE=FREEBSD8
  		;;
+   FreeBSD.9*)	SYSTYPE=FREEBSD9
+ 		;;
    OpenBSD.2*)	SYSTYPE=OPENBSD2
  		;;
    OpenBSD.3*)	SYSTYPE=OPENBSD3
diff -cr --new-file /var/tmp/postfix-2.9.4/src/global/dict_ldap.c ./src/global/dict_ldap.c
*** /var/tmp/postfix-2.9.4/src/global/dict_ldap.c	Tue Jan 31 16:27:12 2012
--- ./src/global/dict_ldap.c	Sat Oct 13 07:50:31 2012
***************
*** 930,937 ****
  #endif
      LDAP_CONN *conn;
  
  #define ADDSTR(vp, s) vstring_memcat((vp), (s), strlen((s))+1)
! #define ADDINT(vp, i) vstring_sprintf_append((vp), "%lu", (unsigned long)(i))
  
      ADDSTR(keybuf, dict_ldap->server_host);
      ADDINT(keybuf, dict_ldap->server_port);
--- 930,940 ----
  #endif
      LDAP_CONN *conn;
  
+     /*
+      * Join key fields with null characters.
+      */
  #define ADDSTR(vp, s) vstring_memcat((vp), (s), strlen((s))+1)
! #define ADDINT(vp, i) vstring_sprintf_append((vp), "%lu%c", (unsigned long)(i), 0)
  
      ADDSTR(keybuf, dict_ldap->server_host);
      ADDINT(keybuf, dict_ldap->server_port);
diff -cr --new-file /var/tmp/postfix-2.9.4/src/global/server_acl.c ./src/global/server_acl.c
*** /var/tmp/postfix-2.9.4/src/global/server_acl.c	Fri Dec 23 21:13:31 2011
--- ./src/global/server_acl.c	Wed Oct  3 10:04:58 2012
***************
*** 112,119 ****
      char   *bp = saved_acl;
      char   *acl;
  
! #define STREQ(x,y) ((*x) == (*y) && strcasecmp((x), (y)) == 0)
! #define STRNE(x,y) ((*x) != (*y) || strcasecmp((x), (y)) != 0)
  
      /*
       * Nested tables are not allowed. Tables are opened before entering the
--- 112,119 ----
      char   *bp = saved_acl;
      char   *acl;
  
! #define STREQ(x,y) (strcasecmp((x), (y)) == 0)
! #define STRNE(x,y) (strcasecmp((x), (y)) != 0)
  
      /*
       * Nested tables are not allowed. Tables are opened before entering the
diff -cr --new-file /var/tmp/postfix-2.9.4/src/oqmgr/qmgr_message.c ./src/oqmgr/qmgr_message.c
*** /var/tmp/postfix-2.9.4/src/oqmgr/qmgr_message.c	Sat Jul 24 16:50:03 2010
--- ./src/oqmgr/qmgr_message.c	Wed Oct 10 17:54:16 2012
***************
*** 749,755 ****
  	if (rec_type > 0)
  	    msg_warn("%s: ignoring out-of-order DSN original recipient <%.200s>",
  		     message->queue_id, dsn_orcpt);
! 	myfree(orig_rcpt);
      }
      if (orig_rcpt != 0) {
  	if (rec_type > 0)
--- 749,755 ----
  	if (rec_type > 0)
  	    msg_warn("%s: ignoring out-of-order DSN original recipient <%.200s>",
  		     message->queue_id, dsn_orcpt);
! 	myfree(dsn_orcpt);
      }
      if (orig_rcpt != 0) {
  	if (rec_type > 0)
diff -cr --new-file /var/tmp/postfix-2.9.4/src/util/ip_match.c ./src/util/ip_match.c
*** /var/tmp/postfix-2.9.4/src/util/ip_match.c	Tue Jan 18 16:35:17 2011
--- ./src/util/ip_match.c	Mon Dec 10 08:50:27 2012
***************
*** 445,451 ****
       * Simplify this if we change to {} for wildcard notation.
       */
  #define FIND_TERMINATOR(start, cp) do { \
! 	int _level = 1; \
  	for (cp = (start) ; *cp; cp++) { \
  	    if (*cp == '[') _level++; \
  	    if (*cp != ']') continue; \
--- 445,451 ----
       * Simplify this if we change to {} for wildcard notation.
       */
  #define FIND_TERMINATOR(start, cp) do { \
! 	int _level = 0; \
  	for (cp = (start) ; *cp; cp++) { \
  	    if (*cp == '[') _level++; \
  	    if (*cp != ']') continue; \
diff -cr --new-file /var/tmp/postfix-2.9.4/src/util/ip_match.in ./src/util/ip_match.in
*** /var/tmp/postfix-2.9.4/src/util/ip_match.in	Tue Jan 18 16:36:34 2011
--- ./src/util/ip_match.in	Wed Dec 12 17:41:41 2012
***************
*** 20,22 ****
--- 20,26 ----
  1.2.3.4x
  1.2.[3..11].5	1.2.3.5	1.2.2.5	1.2.11.5 1.2.12.5  1.2.11.6
  1.2.[3;5;7;9;11].5	1.2.3.5	1.2.2.5	1.2.4.5 1.2.11.5 1.2.12.5  1.2.11.6
+ [1;2].3.4.5 1.3.4.5 2.3.4.5 3.3.4.5
+ [[1;2].3.4.5] 1.3.4.5 2.3.4.5 3.3.4.5
+ [[1;2].3.4.5
+ 1;2].3.4.5
diff -cr --new-file /var/tmp/postfix-2.9.4/src/util/ip_match.ref ./src/util/ip_match.ref
*** /var/tmp/postfix-2.9.4/src/util/ip_match.ref	Tue Jan 18 16:36:34 2011
--- ./src/util/ip_match.ref	Wed Dec 12 17:41:47 2012
***************
*** 53,55 ****
--- 53,69 ----
  Match 1.2.11.5: yes
  Match 1.2.12.5: no
  Match 1.2.11.6: no
+ > [1;2].3.4.5 1.3.4.5 2.3.4.5 3.3.4.5
+ Code: [1;2].3.4.5
+ Match 1.3.4.5: yes
+ Match 2.3.4.5: yes
+ Match 3.3.4.5: no
+ > [[1;2].3.4.5] 1.3.4.5 2.3.4.5 3.3.4.5
+ Code: [1;2].3.4.5
+ Match 1.3.4.5: yes
+ Match 2.3.4.5: yes
+ Match 3.3.4.5: no
+ > [[1;2].3.4.5
+ Error: missing "]" character
+ > 1;2].3.4.5
+ Error: need "." at "1>;<2].3.4.5"
diff -cr --new-file /var/tmp/postfix-2.9.4/src/util/myaddrinfo.c ./src/util/myaddrinfo.c
*** /var/tmp/postfix-2.9.4/src/util/myaddrinfo.c	Tue Feb  1 15:04:28 2011
--- ./src/util/myaddrinfo.c	Wed Oct 31 17:21:03 2012
***************
*** 78,83 ****
--- 78,84 ----
  /*	into printable form. The result buffers should be large
  /*	enough to hold the printable address or port including the
  /*	null terminator.
+ /*	This function strips off the IPv6 datalink suffix.
  /*
  /*	sockaddr_to_hostname() converts a binary network address
  /*	into a hostname or service.  The result buffer should be
***************
*** 202,207 ****
--- 203,209 ----
  #include <msg.h>
  #include <inet_proto.h>
  #include <myaddrinfo.h>
+ #include <split_at.h>
  
  /* Application-specific. */
  
***************
*** 607,622 ****
      }
      return (0);
  #else
  
      /*
       * Native getnameinfo(3) version.
       */
!     return (getnameinfo(sa, salen,
! 			hostaddr ? hostaddr->buf : (char *) 0,
! 			hostaddr ? sizeof(hostaddr->buf) : 0,
! 			portnum ? portnum->buf : (char *) 0,
! 			portnum ? sizeof(portnum->buf) : 0,
! 			NI_NUMERICHOST | NI_NUMERICSERV));
  #endif
  }
  
--- 609,628 ----
      }
      return (0);
  #else
+     int     ret;
  
      /*
       * Native getnameinfo(3) version.
       */
!     ret = getnameinfo(sa, salen,
! 		      hostaddr ? hostaddr->buf : (char *) 0,
! 		      hostaddr ? sizeof(hostaddr->buf) : 0,
! 		      portnum ? portnum->buf : (char *) 0,
! 		      portnum ? sizeof(portnum->buf) : 0,
! 		      NI_NUMERICHOST | NI_NUMERICSERV);
!     if (hostaddr != 0 && ret == 0 && sa->sa_family == AF_INET6)
! 	(void) split_at(hostaddr->buf, '%');
!     return (ret);
  #endif
  }
  
diff -cr --new-file /var/tmp/postfix-2.9.4/src/util/sys_defs.h ./src/util/sys_defs.h
*** /var/tmp/postfix-2.9.4/src/util/sys_defs.h	Tue Jan 17 11:29:55 2012
--- ./src/util/sys_defs.h	Thu Nov 29 18:54:05 2012
***************
*** 25,31 ****
    */
  #if defined(FREEBSD2) || defined(FREEBSD3) || defined(FREEBSD4) \
      || defined(FREEBSD5) || defined(FREEBSD6) || defined(FREEBSD7) \
!     || defined(FREEBSD8) \
      || defined(BSDI2) || defined(BSDI3) || defined(BSDI4) \
      || defined(OPENBSD2) || defined(OPENBSD3) || defined(OPENBSD4) \
      || defined(OPENBSD5) \
--- 25,31 ----
    */
  #if defined(FREEBSD2) || defined(FREEBSD3) || defined(FREEBSD4) \
      || defined(FREEBSD5) || defined(FREEBSD6) || defined(FREEBSD7) \
!     || defined(FREEBSD8) || defined(FREEBSD9) \
      || defined(BSDI2) || defined(BSDI3) || defined(BSDI4) \
      || defined(OPENBSD2) || defined(OPENBSD3) || defined(OPENBSD4) \
      || defined(OPENBSD5) \