From b5896ba9f6047e7031e2bdee0622d543e11a6734 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Mon, 6 May 2024 03:46:30 +0200 Subject: Adding upstream version 3.4.23. Signed-off-by: Daniel Baumann --- proto/IPV6_README.html | 387 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 387 insertions(+) create mode 100644 proto/IPV6_README.html (limited to 'proto/IPV6_README.html') diff --git a/proto/IPV6_README.html b/proto/IPV6_README.html new file mode 100644 index 0000000..25f8353 --- /dev/null +++ b/proto/IPV6_README.html @@ -0,0 +1,387 @@ + + + + + + +Postfix IPv6 Support + + + + + + + +

Postfix +IPv6 Support

+ +

Introduction

+ +

Postfix 2.2 introduces support for the IPv6 (IP version 6) +protocol. IPv6 support for older Postfix versions was available as +an add-on patch. The section "Compatibility with +Postfix <2.2 IPv6 support" below discusses the differences +between these implementations.

+ +

The main feature of interest is that IPv6 uses 128-bit IP +addresses instead of the 32-bit addresses used by IPv4. It can +therefore accommodate a much larger number of hosts and networks +without ugly kluges such as NAT. A side benefit of the much larger +address space is that it makes random network scanning impractical. +

+ +

Postfix uses the same SMTP protocol over IPv6 as it already +uses over the older IPv4 network, and does AAAA record lookups in +the DNS in addition to the older A records. Information about IPv6 +can be found at http://www.ipv6.org/.

+ +

This document provides information on the following topics: +

+ +

Supported platforms + +
Configuration + +
Known limitations + +
Compatibility with Postfix <2.2 IPv6 support + +
IPv6 Support for unsupported platforms + +
Credits + +

+ +

Supported Platforms

+ +

Postfix version 2.2 supports IPv4 and IPv6 on the following +platforms:

+ +

AIX 5.1+ +
Darwin 7.3+ +
FreeBSD 4+ +
Linux 2.4+ +
NetBSD 1.5+ +
OpenBSD 2+ +
Solaris 8+ +
Tru64Unix V5.1+ + +

+ +

On other platforms Postfix will simply use IPv4 as it has always +done.

+ +

See below for tips how to port Postfix +IPv6 support to other environments.

+ +

Configuration

+ +

Postfix IPv6 support introduces two new main.cf configuration +parameters, and introduces an important change in address syntax +notation in match lists such as mynetworks or +debug_peer_list.

+ +

Postfix IPv6 address syntax is a little tricky, because there +are a few places where you must enclose an IPv6 address inside +"[]" characters, and a few places where you must not. It is +a good idea to use "[]" only in the few places where you +have to. Check out the postconf(5) manual whenever you do IPv6 +related configuration work with Postfix.

+ +

Instead of hard-coding 127.0.0.1 and ::1 loopback addresses +in master.cf, specify "inet_interfaces = loopback-only" in main.cf. +This way you can use the same master.cf file regardless of whether +or not Postfix will run on an IPv6-enabled system.
+ +
The first new parameter is called inet_protocols. This +specifies what protocols Postfix will use when it makes or accepts +network connections, and also controls what DNS lookups Postfix +will use when it makes network connections.
+ +
+
```
+/etc/postfix/main.cf:
+    # You must stop/start Postfix after changing this parameter.
+    inet_protocols = ipv4       (DEFAULT: enable IPv4 only)
+    inet_protocols = all        (enable IPv4, and IPv6 if supported)
+    inet_protocols = ipv4, ipv6 (enable both IPv4 and IPv6)
+    inet_protocols = ipv6       (enable IPv6 only)
+
```
+
+ +
By default, Postfix uses IPv4 only, because most systems aren't +attached to an IPv6 network.
+ +
- On systems with combined IPv4/IPv6 stacks, attempts to +deliver mail via IPv6 would always fail with "network unreachable", +and those attempts would only slow down Postfix.
  + +
- Linux kernels don't even load IPv6 protocol support by +default. Any attempt to use it would fail immediately.
  + +
+ +
Note 1: you must stop and start Postfix after changing the +inet_protocols configuration parameter.
+ +
Note 2: if you see error messages like the following, then +you're running Linux and need to turn on IPv6 in the kernel: see +http://www.ipv6.org/ for hints and tips. Unlike other systems, +Linux does not have a combined stack for IPv4 and IPv6, and IPv6 +protocol support is not loaded by default.
+ +
+
```
+postconf: warning: inet_protocols: IPv6 support is disabled: Address family not supported by protocol
+postconf: warning: inet_protocols: configuring for IPv4 support only
+
```
+
+ +
Note 3: on older Linux and Solaris systems, the setting +"inet_protocols = ipv6" will not prevent Postfix from +accepting IPv4 connections. Postfix will present the client IP +addresses in IPv6 format, though. In all other cases, Postfix always +presents IPv4 client IP addresses in the traditional dotted quad +IPv4 format.
+ +
The other new parameter is smtp_bind_address6. +This sets the local interface address for outgoing IPv6 SMTP +connections, just like the smtp_bind_address parameter +does for IPv4:
+ +
+
```
+/etc/postfix/main.cf:
+    smtp_bind_address6 = 2001:240:587:0:250:56ff:fe89:1
+
```
+
+ +
If you left the value of the mynetworks parameter at its +default (i.e. no mynetworks setting in main.cf) Postfix will figure +out by itself what its network addresses are. This is what a typical +setting looks like:
+ +
+
```
+% postconf mynetworks
+mynetworks = 127.0.0.0/8 168.100.189.0/28 [::1]/128 [fe80::]/10 [2001:240:587::]/64 
+
```
+
+ +
If you did specify the mynetworks parameter value in +main.cf, you need update the mynetworks value to include +the IPv6 networks the system is in. Be sure to specify IPv6 address +information inside "[]", like this:
+ +
+
```
+/etc/postfix/main.cf:
+    mynetworks = ...IPv4 networks... [::1]/128 [2001:240:587::]/64 ...
+
```
+
+ +

+ +

NOTE: when configuring Postfix match lists such as +mynetworks or debug_peer_list, you must specify +IPv6 address information inside "[]" in the main.cf parameter +value and in files specified with a "/file/name" pattern. +IPv6 addresses contain the ":" character, and would otherwise be +confused with a "type:table" pattern.

+ +

Known Limitations

+ +

Postfix SMTP clients before version 2.8 try to connect +over IPv6 before trying IPv4. With more recent Postfix versions, +the order of IPv6 versus IPv4 outgoing connection attempts is +configurable with the smtp_address_preference parameter.
+ +
Postfix versions before 2.6 do not support DNSBL (real-time +blackhole list) lookups for IPv6 client IP addresses.
+ +
IPv6 does not have class A, B, C, etc. networks. With IPv6 +networks, the setting "mynetworks_style = class" has the +same effect as the setting "mynetworks_style = subnet". +
+ +
On Tru64Unix and AIX, Postfix can't figure out the local +subnet mask +and always assumes a /128 network. This is a problem only with +"mynetworks_style = subnet" and no explicit mynetworks +setting in main.cf.
+ +

+ +

Compatibility with Postfix <2.2 IPv6 support +

+ +

Postfix version 2.2 IPv6 support is based on the Postfix/IPv6 patch +by Dean Strik and others, but differs in a few minor ways.

+ +

main.cf: The inet_interfaces parameter does not support +the notation "ipv6:all" or "ipv4:all". Use the +inet_protocols parameter instead.
+ +
main.cf: Specify "inet_protocols = all" or +"inet_protocols = ipv4, ipv6" in order to enable both IPv4 +and IPv6 support.
+ +
main.cf: The inet_protocols parameter also controls +what DNS lookups Postfix will attempt to make when delivering or +receiving mail.
+ +
main.cf: Specify "inet_interfaces = loopback-only" +to listen on loopback network interfaces only.
+ +
The lmtp_bind_address and lmtp_bind_address6 +features were omitted. The Postfix LMTP client will be absorbed +into the SMTP client, so there is no reason to keep adding features +to the LMTP client.
+ +
The SMTP server now requires that IPv6 addresses in SMTP +commands are specified as [ipv6:ipv6address], as +described in RFC 2821.
+ +
The IPv6 network address matching code was rewritten from +the ground up, and is expected to be closer to the specification. +The result may be incompatible with the Postfix/IPv6 patch. +
+ +

+ +

IPv6 Support for unsupported platforms

+ +

Getting Postfix IPv6 working on other platforms involves the +following steps:

+ +

Specify how Postfix should find the local network interfaces. +Postfix needs this information to avoid mailer loops and to find out +if mail for user@[ipaddress] is a local or remote destination.
+ +
If your system has the getifaddrs() routine then add +the following to your platform-specific section in +src/util/sys_defs.h:
+ +
+
```
+#ifndef NO_IPV6
+# define HAS_IPV6
+# define HAVE_GETIFADDRS
+#endif
+
```
+
+ +
Otherwise, if your system has the SIOCGLIF ioctl() +command in /usr/include/*/*.h, add the following to your +platform-specific section in src/util/sys_defs.h:
+ +
+
```
+#ifndef NO_IPV6
+# define HAS_IPV6
+# define HAS_SIOCGLIF
+#endif
+
```
+
+ +
Otherwise, Postfix will have to use the old SIOCGIF commands +and get along with reduced IPv6 functionality (it won't be able to +figure out your IPv6 netmasks, which are needed for "mynetworks_style += subnet". Add this to your platform-specific section in +src/util/sys_defs.h:
+ +
+
```
+#ifndef NO_IPV6
+# define HAS_IPV6
+#endif
+
```
+
+ +

Test if Postfix can figure out its interface information.

+ +

After compiling Postfix in the usual manner, step into the +src/util directory and type "make inet_addr_local". +Running this file by hand should produce all the interface addresses +and network masks, for example:

+ +

+% make
+% cd src/util
+% make inet_addr_local
+[... some messages ...]
+% ./inet_addr_local
+[... some messages ...]
+./inet_addr_local: inet_addr_local: configured 2 IPv4 addresses
+./inet_addr_local: inet_addr_local: configured 4 IPv6 addresses
+168.100.189.2/255.255.255.224
+127.0.0.1/255.0.0.0
+fe80:1::2d0:b7ff:fe88:2ca7/ffff:ffff:ffff:ffff::
+2001:240:587:0:2d0:b7ff:fe88:2ca7/ffff:ffff:ffff:ffff::
+fe80:5::1/ffff:ffff:ffff:ffff::
+::1/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+

+ +

The above is for an old FreeBSD machine. Other systems produce +slightly different results, but you get the idea.

+ +

If none of all this produces a usable result, send email to the +postfix-users@postfix.org mailing list and we'll try to help you +through this.

+ +

Credits

+ +

The following information is in part based on information that +was compiled by Dean Strik.

+ +

Mark Huizer wrote the original Postfix IPv6 patch.
+ +
Jun-ichiro 'itojun' Hagino of the KAME project made +substantial improvements. Since then, we speak of the KAME patch. +
+ +
The PLD Linux Distribution ported the code to other stacks +(notably USAGI). We speak of the PLD patch. A very important +feature of the PLD patch was that it can work with Lutz Jaenicke's +TLS patch for Postfix.
+ +
Dean Strik extended IPv6 support to platforms other than +KAME and USAGI, updated the patch to keep up with Postfix development, +and provided a combined IPv6 + TLS patch. Information about his +effort can be found on Dean Strik's Postfix website at +http://www.ipnet6.org/postfix/.
+ +
Wietse Venema took Dean Strik's IPv6 patch, merged it into +Postfix 2.2, and took the opportunity to eliminate all IPv4-specific +code from Postfix that could be removed. For systems without IPv6 +support in the kernel and system libraries, Postfix has a simple +compatibility layer, so that it will use IPv4 as before.
+ +

+ + + + -- cgit v1.2.3