 @@ -1,1552 +1,1552 @@
-#	$NetBSD: 3RDPARTY,v 1.1145.2.8 2015/02/05 15:13:12 martin Exp $
+#	$NetBSD: 3RDPARTY,v 1.1145.2.9 2015/03/03 07:11:08 snj Exp $
+#
 # This file contains a list of the software that has been integrated into
 # NetBSD where we are not the primary maintainer.
+#
 # When you make changes to this software, be sure to discuss it with the
 # maintainer and contribute your patches.  Divergence from the official
 # sources is not desirable, and should be avoided as much as possible.
+#
 # When importing, please deal with the RCS IDs in this way:
 #   1. Preserve the RCS IDs in the files by removing the $ signs from
 #      the IDs before you do the import.
 #   2. After the import, add NetBSD RCS IDs to all of the files.
+#
 # A few notes on the format of this file (for the benefit of
 # 3rdparty2html):
+#
 # 1.) Any line whose first non-whitespace character is # is a comment;
 # 2.) Entries are separated by blank lines;
 # 3.) Every package needs at least the Package, Version, Current Vers,
 #     and Maintainer fields;
 # 4.) Where a field has multiple lines of information, the field tag
 #     should be repeated on each line, except:
 # 5.) The Notes: field tag should appear on a line by itself; all
 #     remaining lines until the end of the record are notes.
+#
 # Package:	name or brief description (required, must be first)
 # Version:	version that is included with NetBSD (required)
 # Current Vers:	version that is available upstream (required)
 # Maintainer:	name and/or email address of upstream maintainer (required)
 # Archive Site:	URL to archive of upstream releases
 # Home Page:	URL to web page for upstream project
 # Mailing List:	email address or URL related to upstream mailing list
 # License:	description of license
 # Responsible:	comma-separated list of NetBSD developers
 # Location:	comma-separated list of subdirectories in the NetBSD src tree
 # Notes:
 # Multiple lines of free-form text,
 # Must be last.
+#
 Package:	acpica
 Version:	20131218
 Current Vers:	20140627
 Maintainer:	Intel
 Archive Site:	http://www.acpica.org/downloads/
 Home Page:	http://www.acpica.org/
 Mailing List:	devel@acpica.org
 License:	BSD-like
 Responsible:	jruoho
 Location:	sys/external/bsd/acpica/dist
 Notes:
 You want the unix2 (dual-licensed) tar file.
 Please read src/sys/dev/acpi/acpica/README before any modification.
 Package:	am-utils [amd]
 Version:	6.2
 Current Vers:	6.2rc1
 Maintainer:	Erez Zadok <ezk@cs.columbia.edu>
 Archive Site:	ftp://ftp.am-utils.org/pub/am-utils/
 Home Page:	http://www.am-utils.org/
 Mailing List:	am-utils
 Responsible:	christos
 License:	BSD (4-clause)
 Location:	external/bsd/am-utils/dist
 Notes:
 Amd2netbsd script to convert to BSD make system and remove unneeded files.
 Fix symbolic links before import.
 Check external/bsd/am-utils/include/config.h is correct after import.
 Package:	Automated Testing Framework (ATF)
 Version:	0.20
 Current Vers:	0.20
 Maintainer:	Julio Merino <jmmv@NetBSD.org>
 Archive site:	https://github.com/jmmv/atf/releases
 Home page:	https://github.com/jmmv/atf
 Mailing List:	atf-devel@NetBSD.org
 Responsible:	jmmv
 License:	The NetBSD Foundation's license (BSD 2-clause)
 Location:	external/bsd/atf/dist
 Notes:
 The source files are in external/bsd/atf/dist.
 Use external/bsd/atf/prepare-import.sh to regenerate the dist/ directory.
 Please avoid performing local changes to this package without discussing
 them with the responsible person and/or the mailing list shown above.
 Note that the external/bsd/atf/dist/tools is owned by NetBSD and does not
 exist upstream; however, please continue to discuss any desired changes
 upfront.
 Package:	ath-hal
 Version:	FreeBSD SVN revision number 185521
 Current Vers:	FreeBSD SVN revision number 185521
 Maintainer:	Sam Leffler <sam@errno.com>
 Archive Site:	none
 Home Page:	none
 Mailing List:	none
 Responsible:	sam, alc
 License:	BSD-like (2-clause), ISC
 Location:	sys/external/isc/atheros_hal/dist
 Notes:
 Package:	bc
 Version:	1.06
 Current Vers:	1.06
 Maintainer:	Phil Nelson <phil@cs.wwu.edu>
 Archive Site:	ftp://ftp.gnu.org/gnu/bc/
 Home Page:	http://www.gnu.org/software/bc/
 Mailing List:	bug-bc@gnu.org
 Responsible:	phil, simonb
 License:	GPLv2, LGPGv2.1
 Location:	gnu/dist/bc
 Notes:
 bc includes dc, both of which are in the NetBSD tree.
 Package:	bind [named and utils]
 Version:	9.10.1-P1
 Current Vers:	9.10.1-P1
 Maintainer:	Paul Vixie <vixie@vix.com>
 Archive Site:	ftp://ftp.isc.org/isc/bind9/
 Home Page:	http://www.isc.org/software/bind/
 Mailing List:	https://lists.isc.org/mailman/listinfo/bind-announce
 Mailing List:	https://lists.isc.org/mailman/listinfo/bind-users
 Responsible:	vixie, christos
 License:	BSD-like (2-clause)
 Location:	external/bsd/bind/dist
 Notes:
 First bind2netbsd script to import into src/external/bsd/bind/dist.
 The Makefiles in src/external/bsd/bind are not handled by the script.
 Build bind to generate the include files.
 Then binclude4netbsd script to import into src/external/bsd/bind/include.
 The libc and include parts of the resolver are now part of libbind.
 Package:	libbind [libc resolver and includes]
 Version:	libbind-6.0-rc1
 Current Vers:	libbind-6.0
 Maintainer:	Paul Vixie <vixie@vix.com>
 Archive Site:	ftp://ftp.isc.org/isc/libbind/
 Home Page:	http://www.isc.org/software/libbind/
 Mailing List:	https://lists.isc.org/mailman/listinfo/bind-workers
 Responsible:	vixie, christos
 License:	BSD-like (2-clause)
 Location:	external/bsd/libbind/dist
 Notes:
 First libbind2netbsd script to import into src/external/bsd/libbind/dist.
 Then include4netbsd script to import into src/include.
 Then libc4netbsd script to update the resolver in libc.
 Todo[1]: Update libresolv if needed.
 Todo[2]: A few files in libc/net were imported in the ISC branch but now
 	 they are too different or do not exist anymore:
 	    gethnamaddr.c getnetent.c getnetnamadr.c sethostent.c
 	 Others like getaddrinfo.c could be merged with isc, but it seems
 	 that ours is from a more recent version of KAME?
 Todo[3]: net/base64.c is imported from bind but should be moved from net
 	 to isc/base64.c.
 Todo[4]: Re-entrant functions of net/*
 Todo[5]: Reconcile the doc directory.
 Package:	binutils
 Version:	2.23.2
 Current Vers:	2.24
 Maintainer:	FSF
 Archive Site:	ftp://ftp.gnu.org/gnu/binutils/
 Home Page:	http://www.gnu.org/software/binutils/
 Mailing List:	bug-gnu-utils@gnu.org
 Responsible:	thorpej, mrg
 License:	GPLv3, LGPLv3, GPLv2, LGPLv2, BSD
 Location:	external/gpl3/binutils/dist
 Notes:
 Package:	bozohttpd
 Version:	20100617
 Current Vers:	20100617
 Maintainer:	mrg@eterna.com.au
 Archive Site:	ftp://ftp.NetBSD.org/pub/NetBSD/packages/distfiles/LOCAL_PORTS/
 Home Page:	http://eterna.com.au/bozohttpd/
 Mailing List:
 Responsible:	mrg
 License:	BSD
 Location:	libexec/httpd
 Notes:
 Delete "queue.h" from the distribution.
 Package:	bsd-family-tree
 Version:	1.151
 Current Vers:	1.156
 Maintainer:	The FreeBSD Project
 Archive Site:	http://www.freebsd.org/cgi/cvsweb.cgi/src/share/misc/bsd-family-tree
 Home Page:	http://www.freebsd.org/cgi/cvsweb.cgi/src/share/misc/bsd-family-tree
 Mailing List:
 Responsible:
 License:	BSD (2-clause) (see http://www.freebsd.org/cgi/cvsweb.cgi/src/COPYRIGHT)
 Location:	share/misc/bsd-family-tree
 Notes:
 Please send all updates upstream.  Eitan Adler <lists@eitanadler.com>
 is a FreeBSD committer who has been helpful with incorporating changes
 in the past.
 Package:	byacc
 Version:	20130304
 Current Vers:	20130925
 Maintainer:	Thomas Dickey <dickey@invisible-island.net>
 Archive Site:	http://www.invisible-island.net/byacc/byacc.html
 Home Page:	http://www.invisible-island.net/byacc/byacc.html
 Mailing List:
 Responsible:	christos
 License:	Public Domain
 Location:	external/bsd/byacc/dist
 Notes:
 See /usr/src/external/bsd/byacc/byacc2netbsd for update instructions.
 Package:	bzip2
 Version:	1.0.6
 Current Vers:	1.0.6
 Maintainer:	Julian Seward <jseward@acm.org>
 Archive Site:	http://sources.redhat.com/bzip2/
 Home Page:	http://www.bzip.org/
 Mailing List:
 Responsible:
 License:	BSD (4-clause)
 Location:	external/bsd/bzip2
 Notes:
 See /usr/src/external/bsd/bzip2/bzip2netbsd for update instructions.
 Package:	Citrus XPG4DL
 Version:
 Current Vers:
 Maintainer:	Citrus
 Archive Site:	http://citrus.bsdclub.org/
 Home Page:	http://citrus.bsdclub.org/
 Mailing List:	bsd-locale@hauN.org
 Responsible:	tshiozak
 License:	Ambiguous. Either BSD or Perl Artistic License
 		See http://citrus.bsdclub.org/#pol_license for more info.
 Location:	lib
 Notes:
 language C multilingualization support suite using wchar_t and other standards.
 The main development playground of Citrus is in NetBSD CVS, so you don't
 need to look for other CVS tree (like citrus CVS tree)
 main trunc has Citrus code in the following places:
 - src/lib/libc/locale, LC_CTYPE: single/multibyte support
 - src/lib/libintl: GNU libc compatible gettext(3) implementation.
 - src/lib/libc/citrus: multibyte LC_CTYPE handling and iconv(3) lower layer
 - src/lib/libc/iconv: iconv(3)
 Package:	cron
 Version:	4.1
 Current Vers:	4.1
 Maintainer:	Paul Vixie <vixie@vix.com>
 Archive Site:	ftp://ftp.isc.org/isc/cron/
 Home Page:
 Mailing List:
 Responsible:
 License:	BSD-like
 Location:	external/bsd/cron/dist
 Notes:
 Package:	cvs
 Version:	1.12.13
 Current Vers:	1.12.13
 Maintainer:	cvshome
 Archive Site:	http://ftp.gnu.org/non-gnu/cvs/
 Home Page:	http://cvs.nongnu.org/
 Mailing List:	bug-cvs@gnu.org
 Responsible:	christos
 License:	GPLv1, LGPLv2
 Location:	external/gpl2/xcvs/dist
 Notes:
 Use external/gpl2/xcvs/dist/cvs2netbsd for preparing the source tree
 for the import.
 Do not forget to update external/gpl2/xcvs/include/config.h to match
 external/gpl2/xcvs/dist/config.h.in.
 Package:	db
 Version:	1.85
 Current Vers:	1.86/4.7.25
 Maintainer:	Keith Bostic <bostic@vangogh.cs.berkeley.edu>
 Archive Site:	http://www.oracle.com/technology/software/products/berkeley-db/
 Home Page:	http://www.oracle.com/database/berkeley-db/
 Mailing List:
 Responsible:
 License:	BSD or Oracle Commercial License
 Location:	lib/libc/db
 Notes:
 Note that we cannot use db 2.x for license reasons.
 Three bug fixes against 1.85 sent back to bostic.  Changes to
 man/recno.3, hash/hsearch.c, and hash/ndbm.c (serious).
 Import of DB 1.85 was done via a sh script which converted the
 distribution into the netbsd format.  The script can be found in
 src/lib/libc/db/db2netbsd.
 Package:	dhcp
 Version:	4.3.0
 Current Vers:	4.3.0
 Maintainer:	mellon
 Archive Site:	ftp://ftp.isc.org/isc/dhcp/
 Home Page:	http://www.isc.org/software/dhcp/
 Mailing List:	dhcp-server@isc.org
 Mailing List:	dhcp-client@isc.org
 Mailing List:	dhcp-announce@isc.org
 Mailing List:	dhcp-bugs@isc.org
 Responsible:	mellon
 License:	BSD (3-clause)
 Location:	external/bsd/dhcp
 Notes:
 Use the dhcp2netbsd script.
 Package:	dhcpcd
 Version:	6.7.1
 Current Vers:	6.7.1
 Maintainer:	roy
 Archive Site:	ftp://roy.marples.name/pub/dhcpcd/
 Home Page:	http://roy.marples.name/projects/dhcpcd/
 Mailing List: 	dhcpcd-discuss@marples.name
 License:	BSD (2-clause)
 Location:	external/bsd/dhcpcd/dist
 Notes:
 Please submit all changes to the author.
 The distribution doesn't include the Linux specific bits or build system.
 Package:	diffutils
 Version:	2.8.1
 Current Vers:	3.3
 Maintainer:	FSF
 Archive Site:	ftp://ftp.gnu.org/gnu/diffutils/
 Home Page:	http://www.gnu.org/software/diffutils/
 Mailing List:	bug-diffutils@gnu.org
 Responsible:
 License:	GPLv2+ (2.8.1), GPLv3+ (2.9 and later)
 Location:	gnu/dist/diffutils
 Notes:
 Use src/gnu/dist/diffutils/diffutils2netbsd for preparing the source tree
 for the import.
 Package:	ekermit
 Version:	1.7
 Current Vers:	1.7
 Maintainer:	Kermit Project
 Archive Site:	ftp://ftp.kermitproject.org/kermit/ekermit/
 Home Page:	http://www.kermitproject.org/ek.html
 Mailing List:
 Responsible:	apb
 License:	BSD (3 clause)
 Location:	external/bsd/ekermit
 Notes:
 Package:	expat
 Version:	2.1.0
 Current Vers:	2.1.0
 Maintainer:	mrg
 Archive Site:	http://sourceforge.net/projects/expat/files/expat/
 Home Page:	http://www.libexpat.org/
 Mailing List:	expat-discuss@libexpat.org
 Responsible:
 License:	MIT
 Location:	src/external/mit/expat/dist
 Notes:
 Please use "expat" as the vendor tag for CVS imports.
 Package:	file
 Version:	5.19
 Current Vers:	5.19
 Maintainer:	Christos Zoulas <christos@zoulas.com>
 Archive Site:	ftp://ftp.astron.com/pub/file/
 Home Page:	http://www.darwinsys.com/file/
 Mailing List:	file@mx.gw.com
 Responsible:	christos, pooka
 License:	BSD (2-clause)
 Location:	external/bsd/file/dist
 Notes:
 use file2netbsd
 Package:	flex
 Version:	2.5.37
 Current Vers:	2.5.37
 Maintainer:	Will Estes <wlestes@users.sourceforge.net>
 Archive Site:	http://flex.sourceforge.net/
 Home Page:	http://flex.sourceforge.net/
 Mailing List:	http://lists.sourceforge.net/mailman/listinfo/flex-announce
 Responsible:
 License:	BSD-like
 Location:	external/bsd/flex/dist
 Notes:
 There is a flex2netbsd script to help newer imports.
 Package:	gcc
 Version:	4.1.3-20080831/4.5.4/4.8.3
 Current Vers:	4.8.3
 Maintainer:	FSF
 Archive Site:	ftp://ftp.gnu.org/gnu/gcc/
 Home Page:	http://www.gnu.org/software/gcc/
 Mailing List:	gcc-bugs@gnu.org
 Responsible:	thorpej, mrg
 License:	GPLv3, LGPLv3.1
 Location:	gnu/dist/gcc4
 Location:	external/gpl3/gcc.old/dist
 Location:	external/gpl3/gcc/dist
 Notes:
 As of April 2014, there are three versions of gcc in the NetBSD tree.
 In the long term, we expect that there will often be two versions,
 in the "gcc" and "gcc.old" directories.  Having two versions allows
 migration from one version of gcc to another to happen for one port
 at a time, instead of for all ports simultaneously.
 When importing a new version of external/gpl3/gcc.old:
 	- copy the current version of external/gpl3/gcc
 	- import it to a "NETBSD" vendor branch in externalgpl3/gcc.old
 Before importing a new version of external/gpl3/gcc:
 	- delete all .cvsignore and .gitignore files
 	- delete java ada fortran their libraries and testsuites
 	- delete libffi zlib boehm-gc
 	- update gcc/version.c for the NetBSD GCC date
 	- use core/c++/objc/testsuite tarballs
 	- you can use the gcc2netbsd script for the above (except version)
 Package:	gdb
 Version:	7.7.1
 Current Vers:	7.7.1
 Maintainer:	FSF
 Archive Site:	ftp://ftp.gnu.org/gnu/gdb/
 Home Page:	http://www.gnu.org/software/gdb/
 Mailing List:	bug-gdb@gnu.org
 Responsible:	christos
 License:	GPLv3, LGPLv3.1
 Location:	external/gpl3/gdb/dist
 Notes:
 When updating GDB, it is imperative to test that:
 	- Debugging of kernel cores ("target kvm") works correctly
 	- Support for our kernel's remote serial debugging protocol
 	  ("options KGDB") works correctly.
 Package:	gdtoa
 Version:	2011-03-19
 Current Vers:	$(date)
 Maintainer:	David M. Gay <dmg@acm.org>
 Archive Site:	http://www.netlib.org/fp/
 Home Page:	http://www.netlib.org/fp/
 Mailing List:	none
 Responsible:	kleink
 License:	BSD-like
 Location:	lib/libc/gdtoa
 Notes:
 Test suite integrated at this time, but not built (and fails to run).
 No hexadecimal floating-point string conversion for VAX FP yet.
 Only double-precision addressed at this time.
 Package:	gettext
 Version:	0.14.4
 Current Vers:	0.18
 Maintainer:	FSF
 Archive Site:	ftp://ftp.gnu.org/gnu/gettext/
 Home Page:	http://www.gnu.org/software/gettext/
 Mailing List:	bug-gnu-utils@gnu.org
 Responsible:
 License:	GPLv2
 Location:	gnu/dist/gettext
 Notes:
 GNU gettext is used for userland tools like msgfmt(1) only.  For libintl,
 we use BSD-licensed implementation from Citrus project (see entry for
 "Citrus XPG4DL").  We hope to replace userland tools with BSD-licensed one.
 Package:	grep
 Version:	2.5.1
 Current Vers:	2.19
 Maintainer:	FSF
 Archive Site:	ftp://ftp.gnu.org/gnu/grep/
 Home Page:	http://www.gnu.org/software/grep/
 Mailing List:	bug-gnu-utils@gnu.org
 Responsible:	simonb
 License:	GPLv2+ (2.5.1), GPLv3+ (2.5.3 and later)
 Location:	gnu/dist/grep
 Notes:
 Use src/gnu/dist/grep/grep2netbsd for preparing the source tree
 for the import.
 On 2 Jan 2004, a non-GNU grep (FreeGrep, https://github.com/howardjp/freegrep;
 see also http://www.monkey.org/openbsd/archive/tech/0306/msg00129.html)
 was imported into src/usr.bin/grep;
 on 16 Feb 2011, the BSD grep implementation from FreeBSD was imported
 in src/usr.bin/grep, replacing FreeGrep
 (http://mail-index.NetBSD.org/source-changes/2011/02/16/msg018643.html).
 Package:	groff
 Version:	1.19.2
 Current Vers:	1.22.2
 Maintainer:	Werner Lemberg/FSF
 Archive Site:	ftp://ftp.gnu.org/gnu/groff/
 Home Page:	http://www.gnu.org/software/groff/
 Mailing List:	bug-groff@gnu.org
 Responsible:
 License:	GPLv2
 Location:	gnu/dist/groff
 Notes:
 Use groff2netbsd from src/gnu/dist/groff to prepare the distribution
 for import.
 Package:	heimdal
 Version:	1.5.3
 Current Vers:	1.5.3
 Maintainer:	Heimdal <heimdal@pdc.kth.se>
 Archive Site:	ftp://ftp.pdc.kth.se/pub/heimdal/src/
 Home Page:	http://www.pdc.kth.se/heimdal/
 Mailing List:	heimdal-discuss@pdc.kth.se
 Responsible:	joda, lha
 License:	BSD
 Location:	crypto/external/bsd/heimdal/dist
 Notes:
 Package:	hunt
 Version:	2003-04-16
 Current Vers:	2003-04-16
 Maintainer:	Greg Couch <gregc@cgl.ucsf.edu>
 Archive Site:	ftp://ftp.cgl.ucsf.edu/pub/hunt.shar.Z
 Home Page:	http://www.cgl.ucsf.edu/home/gregc/oss.html
 Responsible:	mrg
 License:	BSD (3-clause)
 Location:	games/hunt
 Notes:
 Package:	ipf
 Version:	5.1.1
 Current Vers:	5.1.2
 Maintainer:	Darren Reed
 Archive Site:	http://coombs.anu.edu.au/~avalon/
 Home Page:	http://coombs.anu.edu.au/~avalon/
 Mailing List:	ipfilter@postbox.anu.edu.au
 Responsible:	darrenr, christos
 License:	BSD-based; see src/external/ipf/dist/IPFILTER.LICENCE
 Location:	external/bsd/ipf,sys/external/bsd/ipf
 Notes:
 ipf2netbsd should be used on a virgin ipfilter source tree.
 Package:	ipsec-tools
 Version:	(ipsec-tools head is NetBSD-current head)
 Maintainer:	IPsec-Tools project <ipsec-tools-core@lists.sourceforge.net>
 Archive Site:	http://ipsec-tools.sourceforge.net
 Home Page:	http://ipsec-tools.sourceforge.net
 Mailing List:	ipsec-tools-devel@lists.sourceforge.net
 Responsible:	manu, vanhu, mgrooms
 License:	BSD (3-clause)
 Location:	crypto/dist/ipsec-tools
 Notes:
 ipsec-tools is maintained within NetBSD src tree in src/crypto/dist/ipsec-tools
 We don't run ipsec-tools' configure as part of the NetBSD build. configure
 generated files are available in the NetBSD source tree at:
   src/lib/libipsec/config.h
   src/lib/libipsec/package_version.h
 When configure.ac is updated, run the following:
   cd src/crypto/dist/ipsec-tools
   ./bootstrap
   ./configure --enable-adminport --enable-hybrid --enable-frag \
   	      --enable-natt --enable-dpd
 Then copy package_version.h to src/lib/libipsec and merge config.h with
 src/lib/libipsec/config.h (it needs some manual tweaking)
 NOTE: As NetBSD HEAD and ipsec-tools HEAD are just the same thing,
 NetBSD-current always contains latest ipsec-tools code. On the other hand,
 ipsec-tools has stable branches (e.g.: ipsec-tools-0_7-branch), which
 are manually pulled up to NetBSD stable branches (e.g.: netbsd-4 is regularly
 sync with ipsec-tools-0_7-branch)
 Package:	KAME IPv6
 Version:	KAME/NetBSD SNAP kit
 Current Vers:	KAME/NetBSD SNAP kit (shipped every week)
 Maintainer:	KAME Project <kame@kame.net>
 Archive Site:	http://www.kame.net/
 Home Page:	http://www.kame.net/
 Mailing List:	snap-users@kame.net
 Responsible:
 License:	BSD (3-clause)
 Location:	sys/netinet6
 Notes:
 IPv6 part is based on KAME/NetBSD142 SNAP as of early June 2000, with
 more conservative implementation policy.
 IPsec part is based on KAME/NetBSD14 SNAP as of 12 June 2000.
 Please do not make too many diff-unfriendly changes (like indentation change,
 KNF police).  We need to take diffs across KAME snapshots on upgrades.
 To identify kernel version, check net.inet6.ip6.kame_version, or KAME_VERSION
 in sys/netinet6/in6.h.  No script is available for upgrades.
 "KAME" branch is used for kernel merge work purposes.
 http://www.kame.net/dev/cvsweb.cgi/kame/COVERAGE has functionality comparison
 among KAME/*BSD, *BSD-current and recent *BSD releases.
 Package:	kyua-atf-compat
 Version:	0.1
 Current Vers:	0.1
 Maintainer:	Julio Merino <jmmv@NetBSD.org>
 Archive site:	http://code.google.com/p/kyua/downloads/list?can=1
 Home page:	http://code.google.com/p/kyua/
 Mailing List:	kyua-discuss@googlegroups.com
 Responsible:	jmmv
 License:	BSD 3-clause
 Location:	external/bsd/kyua-atf-compat/dist
 Notes:
 The source files are in external/bsd/kyua-atf-compat/dist.
 Use external/bsd/kyua-atf-compat/prepare-import.sh to regenerate the dist/
 directory.
 Package:	kyua-cli
 Version:	0.7
 Current Vers:	0.7
 Maintainer:	Julio Merino <jmmv@NetBSD.org>
 Archive site:	http://code.google.com/p/kyua/downloads/list?can=1
 Home page:	http://code.google.com/p/kyua/
 Mailing List:	kyua-discuss@googlegroups.com
 Responsible:	jmmv
 License:	BSD 3-clause
 Location:	external/bsd/kyua-cli/dist
 Notes:
 The source files are in external/bsd/kyua-cli/dist.
 Use external/bsd/kyua-cli/prepare-import.sh to regenerate the dist/ directory.
 Package:	kyua-testers
 Version:	0.1
 Current Vers:	0.1
 Maintainer:	Julio Merino <jmmv@NetBSD.org>
 Archive site:	http://code.google.com/p/kyua/downloads/list?can=1
 Home page:	http://code.google.com/p/kyua/
 Mailing List:	kyua-discuss@googlegroups.com
 Responsible:	jmmv
 License:	BSD 3-clause
 Location:	external/bsd/kyua-testers/dist
 Notes:
 The source files are in external/bsd/kyua-testers/dist.
 Use external/bsd/kyua-testers/prepare-import.sh to regenerate the dist/
 directory.
 Package:	less
 Version:	less-458
 Current Vers:	less-458
 Maintainer:	Mark Nudelman <markn@greenwoodsoftware.com>
 Archive Site:	http://www.greenwoodsoftware.com/less/download.html
 Home Page:	http://www.greenwoodsoftware.com/less/
 Mailing List:	less-announce-request@greenwoodsoftware.com
 Responsible:	mrg
 License:	Less License (BSD 2-clause) or GPLv3 (v2 prior to less-418)
 Location:	external/bsd/less/dist
 Notes:
 Many changes to make less act as more when invoked as more.  Beware.
 Use the "src/external/bsd/less/less2netbsd" script to prepare source tree
 for importation.  Run ./configure beforehand to generate "defines.h".
 Talk to mrg before importing any new version.
 Package:	libarchive
 Version:	2.8.4
 Current Vers:	2.8.5 (legacy) / 3.0.4 (stable)
 Maintainer:	kientzle@freebsd.org, joerg@NetBSD.org
 Archive Site:	https://github.com/libarchive/libarchive/downloads
 Home Page: 	http://libarchive.github.com/
 Responsible:	joerg
 License:	BSD (2-clause)
 Location:	external/bsd/libarchive/dist
 Notes:
 Distribution is stripped down to the relevant part.
 Package:	libdevmapper
 Version:	1.02.40
 Current Vers:	2.02.98
 Maintainer:	lvm-devel@redhat.com
 Archive Site:	ftp://sources.redhat.com/pub/lvm2/
 Home Page:	http://sources.redhat.com/lvm2/
 Responsible:	haad
 License:	LGPLv2.1
 Location:	external/gpl2/lvm2/dist/libdm
 Notes:
 The lvm2tools and the libdevmapper are now distributed as one source
 repository. See the lvm2tools Notes for more information.
 Package:	libevent
 Version:	2.0.21-stable
 Current Vers:	2.0.21-stable
 Maintainer:	Niels Provos <provos@citi.umich.edu>
 Archive Site:	http://www.monkey.org/~provos/libevent/
 Home Page:	http://www.monkey.org/~provos/libevent/
 Responsible:	provos
 License:	BSD (3/4-clause)
 Location:	external/bsd/libevent/dist
 Notes:
 - Run the libevent2netbsd script
 - Build the doxygen man pages. Edit the Doxyfile to GENERATE_MAN=yes.
   man pages are in doxygen/man/man3. Remove the extra man pages that are
   .so'ing only. Copy the rest to man.
 Package:	llvm
 Version:	3.4rc1 (r195771)
 Current Vers.:	3.4rc1
 Maintainer:	llvmdev@cs.uiuc.edu
 Home Page:	http://llvm.org
 Responsible:	joerg
 License:	BSD/MIT
 Location:	external/bsd/llvm/dist
 Notes:
 A CVS ACL is in place for the location to prevent unintentioned commits.
 All changes should come via import from upstream SVN.
 Package:	lvm2tools
 Version:	2.02.56
 Current Vers:	2.02.56
 Maintainer:	lvm-devel@redhat.com
 Archive Site:	ftp://sources.redhat.com/pub/lvm2/
 Home Page:	http://sources.redhat.com/lvm2/
 Responsible:	haad
 License:	GPLv2
 Location:	external/gpl2/lvm2/dist
 Notes:
 Use the src/external/gpl2/lvm2tools/dist/lvm2netbsd script to prepare source tree
 for import. Keep eye on dist/include/configure.h it migh change over the releases.
 We maintain our own version of libdevmapper ioctl protocol code, therefore we
 should test it before import. Talk to haad before importing new version.
 Package:	libpcap
 Version:	1.5.2
 Current Vers:	1.5.2
 Maintainer:	tcpdump-workers@tcpdump.org
 Archive Site:	http://www.tcpdump.org/release/
 Home Page:	http://www.tcpdump.org/
 Mailing List:	tcpdump-workers@tcpdump.org
 Responsible:	dyoung
 License:	BSD (3/4-clause)
 Location:	external/bsd/libpcap/dist
 Notes:
 Use the src/external/bsd/libpcap/libpcap2netbsd script to prepare source
 tree. sys/net/dlt.h is a copy of the dlt constants from pcap.h
 Package:	libwrap
 Version:	tcp_wrappers 7.6 w/ large amount of IPv6 changes
 Current Vers:	tcp_wrappers 7.6-ipv6.4
 Maintainer:	Wietse Venema <wietse@porcupine.org>
 Archive Site:	ftp://ftp.porcupine.org/pub/security/
 Home Page:	ftp://ftp.porcupine.org/pub/security/
 Mailing List:
 Responsible:	cjs
 License:	BSD-like
 Location:	lib/libwrap
 Notes:
 We import only libwrap (under src/lib), tcpdchk and tcpdmatch (both
 under src/usr.sbin). We don't use tcpd; that functionality is built
 into inetd. The provided libwrap2netbsd script handles just libwrap.
 Package:	Lua
 Version:	Lua 5.1.5
 Current Vers:	Lua 5.2.2
 Maintainer:	PUC Rio
 Home Page:	http://www.lua.org/
 Mailing List:
 Responsible:	mbalmer
 License:	MIT
 Location:	external/mit/lua/dist
 Notes:
 The default module paths have been changed to not include the current
 working directory '.' to avoid potential security problems.
 Package:	Lutok
 Version:	0.3
 Current Vers:	0.3
 Maintainer:	Julio Merino <jmmv@NetBSD.org>
 Archive site:	http://code.google.com/p/lutok/downloads/list?can=1
 Home page:	http://code.google.com/p/lutok/
 Mailing List:	lutok-discuss@googlegroups.com
 Responsible:	jmmv
 License:	BSD 3-clause
 Location:	external/bsd/lutok/dist
 Notes:
 The source files are in external/bsd/lutok/dist.
 Use external/bsd/lutok/prepare-import.sh to regenerate the dist/ directory.
 Package:	m4
 Version:	20091026
 Current Vers:	20091026
 Maintainer:	The OpenBSD Project
 Archive Site:	http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/m4
 Home Page:	http://www.openbsd.org/
 Mailing List:
 License:	BSD 3-clause like (dns-sd)
 Responsible:	christos
 Location:	usr.bin/m4
 Notes:
 Uses libc's ohash, and strtonum
 Package:	mDNSResponder
 Version:	320.16
 Current Vers:	541
 Maintainer:	Apple
 Archive Site:	http://www.opensource.apple.com/tarballs/mDNSResponder/
 Home Page:	http://developer.apple.com/opensource/internet/bonjour.html
 Mailing List:	bonjour-dev@lists.apple.com
 License:	Apache2 (mdnsd), BSD 3-clause (libdns_sd),
 		BSD 3-clause like (dns-sd)
 Responsible:	tsarna
 Location:	external/apache2/mDNSResponder/dist
 Notes:
 Package:	mdocml
 Version:	1.12.1
 Current Vers:	1.13.1
 Maintainer:	Kristaps Džonsons
 Archive Site:	http://mdocml.bsd.lv/snapshots/
 Home Page:	http://mdocml.bsd.lv/
 Mailing List:
 Responsible:	joerg
 License:	BSD (2-clause)
 Location:	external/bsd/mdocml/dist
 Notes:
 Package:	mesa-demos
 Version:	8.1.0
 Current Vers:	8.2.0
 Maintainer:	mesa-git@?
 Archive Site:	ftp://ftp.freedesktop.org/pub/mesa/demos/
 Home Page:	http://www.mesa3d.org/
 Mailing List:
 Responsible:	riastradh, mrg
 License:	ISC
 Location:	xsrc/external/mit/MesaDemos/dist
 Notes:
 We use only glxinfo and glxgears.  Delete all else on import.
 Vendor tag:	xorg
 Release tag:	mesa-demos-X-Y-Z
 Package:	mesa-drm
 Version:	git 85b9f737db0d2a845e4d7e2bbf9ad12ff9e2227c
 Current Vers:
 Maintainer:	mesa-git@?
 Archive Site:	git://anongit.freedesktop.org/git/mesa/drm
 Home Page:	http://cgit.freedesktop.org/mesa/drm/
 Mailing List:
 Responsible:	mrg, bjs
 License:	BSD
 Location:	sys/external/bsd/drm/dist
 Notes:
 Package:	MesaLib
 Version:	7.11.2
 Current Vers:	10.2.3
 Maintainer:	mesa-git@?
 Archive Site:	ftp://ftp.freedesktop.org/pub/mesa/
 Home Page:	http://www.mesa3d.org/
 Mailing List:
 Responsible:	riastradh, mrg
 License:	ISC
 Location:	xsrc/external/mit/MesaLib/dist
 Notes:
 Vendor tag:	xorg
 Release tag:	MesaLib-X-Y-Z
 Package:	mopd
 Version:	2.5.3
 Current Vers:	2.5.3
 Maintainer:	Mats O Jansson <maja@celsiustech.se>
 Archive Site:	http://www.stacken.kth.se/~moj/mopd.html
 Home Page:	http://www.stacken.kth.se/~moj/mopd.html
 Mailing List:
 Responsible:	cjs
 License:	BSD (4-clause)
 Location:	usr.sbin/mopd
 Notes:
 Delete the otherOS directory before importing.
 Package:	nawk
 Version:	2012-12-20
 Current Vers:	2012-12-20
 Maintainer:	Brian Kernighan <bwk@princeton.edu>
 Archive Site:	http://www.cs.princeton.edu/~bwk/btl.mirror/
 Home Page:	http://www.cs.princeton.edu/~bwk/btl.mirror/
 Mailing List:
 Responsible:	jdolecek
 License:	BSD-like
 Location:	external/historical/nawk/dist
 Notes:
 Build maketab from nawk sources and generate proctab.c.
 Remove buildwin.bat, missing95.c, ytab.[ch], ytab?.bak, vcvars.bat makefile.win
 then import to src/external/historical/nawk/dist.
 Package:	ndbootd
 Version:	0.5
 Current Vers:	0.5
 Maintainer:	Matt Fredette <fredette@alum.mit.edu>
 Archive Site:
 Home Page:
 Responsible:	fredette
 License:	BSD (4-clause)
 Location:	usr.sbin/ndbootd
 Notes:
 Run ./configure, save config.h, make distclean, rm all autoconf/automake
 and ndbootd-raw.c.  Restore saved config.h, and force it to define
 HAVE_STRICT_ALIGNMENT.  Fix RCS IDs, import.
 Package:	ntp
 Version:	4.2.7p404
 Current Vers:	4.2.6p5/4.2.7p404
 Maintainer:	David L. Mills <mills@udel.edu>
 Archive Site:	http://www.ntp.org/
 Home Page:	http://www.ntp.org/, http://support.ntp.org/
 Mailing List:
 Responsible:	simonb, jonathan, kardel
 License:	BSD-like
 Location:	external/bsd/ntp/dist
 Notes:
 See /usr/src/dist/ntp/ntp2netbsd for update instructions.
 Package:	nvi
 Version:	1.81.6, HEAD as of 2013-11-20
 Current Vers:	1.81.6
 Maintainer:	Sven Verdoolaege <skimo@kotnet.org>, Keith Bostic
 Archive Site:	git://repo.or.cz/nvi.git, ftp://ftp.bostic.com/pub/
 Home Page:	https://repo.or.cz/w/nvi.git http://www.bostic.com/vi/
 Mailing List:
 Responsible:	christos
 License:	BSD (3/4-clause)
 Location:	external/bsd/nvi/dist
 Notes:
 We have lots of local fixes.
 Package:	OpenLDAP
 Version:	2.4.39
 Current Vers:	2.4.39
 Maintainer:	OpenLDAP Foundation
 Archive Site:	http://www.openldap.org/
 Home Page:	http://www.openldap.org/
 Mailing List:
 Responsible:
 License:	BSD (3-clause)
 Location:	external/bsd/openldap/dist
 Notes:
 Package:	OpenPAM
 Version:	20130907 (Nummularia)
 Current Vers:	20130907 (Nummularia)
 Maintainer:	Dag-Erling Smørgrav <des@FreeBSD.org>
 Archive Site:	http://www.openpam.org/
 Home Page:	http://www.openpam.org/
 Mailing List:
 Responsible:	christos
 License:	BSD (3-clause)
 Location:	external/bsd/openpam/dist
 Notes:
 Next import will need moving lib sources to lib/libpam
 Package:	openresolv
 Version:	3.5.6
 Current Vers:	3.5.6
 Maintainer:	roy
 Archive Site:	ftp://roy.marples.name/pub/openresolv/
 Home Page:	http://roy.marples.name/projects/openresolv/
 Mailing List: 	openresolv-discuss@marples.name
 License:	BSD (2-clause)
 Location:	external/bsd/openresolv/dist
 Notes:
 Please submit all changes to the author.
 Package:	HPN-SSH
 Version:	6.1p1 13 v14
 Current Vers:	6.3p1 v14
 Maintainer:	www.psc.edu
 Archive Site:	No direct link anymore, @#$#$ psc.
 Home Page:	http://www.psc.edu/index.php/hpn-ssh
 Mailing List:
 Responsible:	christos
 License:
 Location:	crypto/external/bsd/openssh/dist
 Notes:
 Patch applied after OpenSSH import.
 Package:	OpenSSH
 Version:	6.4
 Current Vers:	6.4 / portable 6.4p1
 Maintainer:	OpenSSH
 Archive Site:	http://www.openssh.com/ftp.html
 Home Page:	http://www.openssh.com/portable.html
 Mailing List:	openssh-unix-announce@mindrot.org
 Responsible:	thorpej, christos, elric
 License:	BSD. See src/crypto/external/bsd/openssh/dist/LICENSE
 Location:	crypto/external/bsd/openssh/dist
 Notes:
 imported from OpenBSD ssh -- is not from the portable OpenSSH
 use openssh2netbsd before import.
 local changes (should always try to bring them back to master openssh tree,
 markus is very cooperative about it):
 - default for PermitRootLogin is set to "no"
 - IgnoreRootRhosts added
 - look at login.conf to check valid user/access list
 - krb5 support re-added
 - hack in cipher.c #ifdef ACCS because we are missing EVP_acss
   when someone imports openssl, we can remove this.
 - added moduli from portable openssh
 - added USE_PAM patches and auth_pam.[ch] from portable openssh
   (see if there is any difference between the current version of opensshX.Yp1
    and the new opensshZ.Wp1) and apply them.
 - conditionalize login_cap
 - conditionalize bsd_auth
 - restore krb5, krb4, afs, skey
 - bring in hpn patches, disable mt aes cipher, keep speedups and cipher none
 - fix ctype macro arguments
 - umac is broken, disable it
 - better ~homedir handling
 - netbsd style tunnels
 - urandom, xhome, chrootdir, rescuedir NetBSD handling
 - utmp/utmpx handling
 - handle tty posix_vdisable properly
 - handle setuid and unsetuid the posix way instead of setresuid()
 - add all missing functions
 - always bump major when importing to avoid api problems.
 - make compile with gcc-4.5; const fixes, fileno() checks, shadow fixes.
 Package:	OpenSSL
 Version:	1.0.1k
 Current Vers:	1.0.1k
 Maintainer:	The OpenSSL Project
 Archive Site:	ftp://ftp.openssl.org/source/
 Home Page:	http://www.openssl.org/
 Mailing List:	openssl-announce@openssl.org
 Responsible:	christos, mjf, tls, riastradh, spz
 License:	OpenSSL and SSLeay license (both BSD-like)
 Location:	crypto/external/bsd/openssl/dist
 Notes:
 - Run openssl2netbsd to get rid of the RCSID identifiers
 - run make in /usr/src/crypto/external/bsd/openssl/lib/libcrypto/man
   to regen man pages.
 - run make in  /usr/src/crypto/external/bsd/openssl/lib/libcrypto/arch/*
   to regen assembly files
 Package:	pcc
 Version:	1.1.0.DEVEL 20120325
 Current Vers:	1.1.0.DEVEL 20120325
 Maintainer:	Anders Magnusson <ragge@NetBSD.org>
 Archive Site:	ftp://pcc.ludd.ltu.se/pub/pcc/
 Home Page:	http://pcc.ludd.ltu.se/
 Mailing List:	pcc-list@ludd.ltu.se
 Responsible:	plunky
 License:	BSD
 Location:	external/bsd/pcc/dist
 Notes:
 This is a development snapshot. See the src/external/bsd/pcc/prepare-import.sh
 file for details about how to get the latest version from the upstream server
 and import it.
 Package:	pdisk
 Version:	0.8a2
 Current Vers:	0.8a2
 Maintainer:	Eryk Vershen <eryk@cfcl.com>
 Archive Site:	http://cantaforda.com/cfcl/eryk/linux/pdisk/index.html
 Home Page:	http://cantaforda.com/cfcl/eryk/linux/pdisk/index.html
 Mailing List:
 Responsible:	dbj
 License:	BSD-like
 Location:	external/bsd/pdisk
 Notes:
 This is the disk partition utility used by Apple's mkLinux and OS X
 It is imported into external/bsd/pdisk.
 Package:	pdksh
 Version:	5.2.14p2
 Current Vers:	5.2.14p2
 Maintainer:	Michael Rendell <michael@cs.mun.ca>
 Archive Site:	ftp://ftp.cs.mun.ca/pub/pdksh/
 Home Page:	http://www.cs.mun.ca/~michael/pdksh/
 Mailing List:
 Responsible:	jdolecek
 License:	Public domain
 Location:	bin/ksh
 Notes:
 pdksh-5.2.14-patches.1 and pdksh-5.2.14-patches.2 have been applied.
 Package:	PF (openbsd packet filter)
 Version:	OpenBSD 4.2
 Current Vers:	OpenBSD 4.3-current
 Maintainer:	The OpenBSD Project
 Archive Site:	ftp://ftp.openbsd.org/
 Home Page:	http://www.openbsd.org/faq/pf/
 Mailing List:	pf@benzedrine.cx or appropriate OpenBSD mailing list
 Responsible:	peter, yamt
 License:	BSD (2-clause)
 Location:	dist/pf,sys/dist/pf
 Notes:
 kernel code is imported into src/sys/dist/pf and src/sys/net has reachover
 definition (files.pf).  userland code is imported into src/dist/pf, and
 reachover Makefiles are in src/usr.sbin/pf.
 Package:	pkg_install
 Version:	20120221
 Current Vers:	20120221
 Maintainer:	The pkgsrc developers
 Home Page:	http://www.pkgsrc.org/
 Mailing List:	tech-pkg@NetBSD.org
 Responsible:	joerg
 License:	BSD
 Location:	external/bsd/pkg_install/dist
 Notes:
 The authoritative version is in pkgsrc/pkgtools/pkg_install.
 Package:	ping
 Version:	980911
 Current Vers:	980911
 Maintainer:	Mike Muuss
 Archive Site:
 Home Page:	http://ftp.arl.mil/mike/ping.html
 Mailing List:
 Responsible:	christos
 License:	BSD (3-clause)
 Location:	sbin/ping
 Notes:
 We use err() and friends. We have changes for snprintf, extra
 formatting in man pages, disallowing flood pinging, alignment fixes,
 and more. Vern's ping is gone. We are too different from everyone else
 now to do a new import.
 Package:	Postfix
-Version:	2.11.3
+Version:	3.0
-Current Vers:	2.11.3
+Current Vers:	2.11.4
 Maintainer:	Wietse Venema <wietse@porcupine.org>
 Archive Site:	ftp://postfix.cloud9.net/official/
 Home Page:	http://www.postfix.org/
 Mailing List:	postfix-users@postfix.org
 Responsible:	christos, tron
 License:	IBM Public License. See also src/external/ibm-public/postfix/dist.
 Location:	external/ibm-public/postfix/dist
 Notes:
 HTML documentation should be kept in sync with the README_FILES.
 src/gnu/dist/postfix/conf/postfix-files must be kept in sync with our
 directory layout (the easiest way to check is by running ``postfix
 set-permissions'').
 Package:	ppp
 Version:	2.4.7
 Current Vers:	2.4.7
 Maintainer:	Paul Mackerras <paulus@samba.org>
 Archive Site:	ftp://ftp.samba.org/pub/ppp/
 Home Page:
 GIT root:	git://ozlabs.org/~paulus/ppp.git
 Mailing List:
 Responsible:	christos, cube
 License:	BSD (3-clause)
 Location:	external/bsd/ppp/dist
 Notes:
 BSD support was removed from 2.4.0; I added it back and removed
 some GPL pieces. Multilink support is missing. Repeated pings to
 Paulus have not yielded results. I've retrofitted pppdump to use
 net/zlib, and <net/ppp-comp.h> and I now maintain sys-bsd.c. This
 is clearly a pain. I have not tested the modules code, neither our
 makefiles make it easy to construct a module, but I left one there
 as an example.
 TDB code as found in 2.4.x, x>1 is under the GPL.  Therefore, we're
 using the version found in 2.4.1.
 Package:	rcs
 Version:	5.7
 Current Vers:	5.9.2
 Maintainer:	FSF
 Archive Site:	ftp://ftp.gnu.org/gnu/rcs/
 Mailing List:	bug-gnu-utils@gnu.org
 Home Page:	http://www.gnu.org/software/rcs/
 Responsible:	agc
 License:	GPLv2+ (5.7), GPLv3+ (5.8 and later)
 Location:	gnu/usr.bin/rcs
 Notes:
 Old versions are available from Purdue (ftp.cs.purdue.edu:/pub/RCS).
 Package:	root.cache
 Version:	2014060201 (June 2, 2014)
 Current Vers:	2014060201 (June 2, 2014)
 Maintainer:	InterNIC
 Archive Site:	ftp://ftp.internic.net/domain/named.root
 Home Page:	ftp://ftp.internic.net/domain/named.root
 Mailing List:
 Responsible:	thorpej
 License:	Public domain
 Location:	etc/namedb
 Notes:
 The root server cache is also included with BIND.  However, the
 InterNIC version is usually more up to date.
 Package:	routed
 Version:	2.32
 Current Vers:	2.32
 Maintainer:	Vernon Schryver <vjs@rhyolite.com>
 Archive Site:	ftp://ftp.rhyolite.com/src/
 Home Page:	http://www.rhyolite.com/src/
 Mailing List:
 Responsible:	christos
 License:	BSD (4-clause)
 Location:	sbin/routed
 Notes:
 We use the md5 code from libc
 We don't allow RIP_TRACEON and RIP_TRACEOFF
 We use arc4random
 We use strlcpy/snprintf
 Package:	send-pr (part of GNATS)
 Version:	3.95
 Current Vers:	4.1
 Maintainer:	FSF
 Archive Site:	ftp://ftp.gnu.org/gnu/gnats/
 Home Page:	http://www.gnu.org/software/gnats/
 Mailing List:	bug-gnats@gnu.org
 License:	GPLv2
 Responsible:
 Location:	gnu/usr.bin/send-pr
 Notes:
 Package:	SoftFloat
 Version:	2a
 Current Vers:	2b
 Maintainer:	John Hauser <jhauser@jhauser.us>
 Archive Site:	http://www.jhauser.us/arithmetic/SoftFloat.html
 Home Page:	http://www.jhauser.us/arithmetic/SoftFloat.html
 Mailing List:
 Responsible:	bjh21
 License:	Public domain
 Location:	lib/libc/softfloat
 Notes:
 Heavily modified for use as a soft float library for GCC.  The actual
 arithmetic code is unchanged, though, and should behave exactly like the
 original.
 Package:	sqlite
 Version:	3.8.3.1
 Current Vers:	3.8.3.1
 Maintainer:	Richard Hipp <drh@sqlite.org>
 Home Page:	http://www.sqlite.org
 Responsible:	joerg
 License:	Public domain
 Location:	external/public-domain/sqlite/dist
 Notes:
 Run cleantags before inporting because sqlite3.c has an RCSID
 Package:	tcpdump
 Version:	4.5.1
 Current Vers:	4.5.1
 Maintainer:	tcpdump-workers@lists.tcpdump.org
 Archive Site:	http://www.tcpdump.org/release/
 Home Page:	http://www.tcpdump.org/
 Mailing List:	tcpdump-workers@lists.tcpdump.org
 Responsible:
 License:	BSD (3-clause)
 Location:	external/bsd/tcpdump/dist
 Notes:
 Use the src/external/bsd/tcpdump/tcpdump2netbsd script to prepare source
 tree.
 Package:	TestFloat
 Version:	2a
 Current Vers:	2a
 Maintainer:	John Hauser <jhauser@jhauser.us>
 Archive Site:	http://www.jhauser.us/arithmetic/TestFloat.html
 Home Page:	http://www.jhauser.us/arithmetic/TestFloat.html
 Mailing List:
 Responsible:	ross
 License:	BSD (4-clause)
 Location:	regress/lib/libc/ieeefp/testfloat
 Notes:
 Package:	texinfo
 Version:	4.8
 Current Vers:	5.2
 Maintainer:	FSF
 Archive Site:	ftp://ftp.gnu.org/gnu/texinfo/
 Home Page:	http://www.gnu.org/software/texinfo/
 Mailing List:	bug-texinfo@gnu.org
 Responsible:
 License:	GPLv2+ (4.8), GPLv3+ (4.9 and later)
 Location:	gnu/dist/texinfo
 Notes:
 Use src/gnu/dist/texinfo/texinfo2netbsd for preparing the source tree
 for the import.
 Package:	tmux
 Version:	1.9a
 Current Vers:	1.9a
 Maintainer:	Nicholas Marriott <nicm@users.sourceforge.net>
 Archive site:	http://downloads.sourceforge.net/tmux/
 Home page:	http://tmux.sourceforge.net/
 Mailing List:	tmux-users@lists.sourceforge.net
 Responsible:	jmmv
 License:	BSD
 Location:	external/bsd/tmux/dist
 Notes:
 See src/external/bsd/tmux/README for instructions on how to import a
 new tmux release.
 Package:	top
 Version:	3.8beta1
 Current Vers:	3.8beta1
 Maintainer:	William LeFebvre <wnl@groupsys.com>
 Archive Site:	http://www.unixtop.org/dist/top-3.8beta1.tar.gz
 Home Page:	http://www.unixtop.org/
 Mailing List:	top-spinners@ocee.groupsys.com
 Responsible:	simonb, christos
 License:	BSD (2-clause)
 Location:	external/bsd/top/dist
 Notes:
 Package:	traceroute
 Version:	1.4a12
 Current Vers:	1.4a12
 Maintainer:	traceroute@ee.lbl.gov
 Archive Site:	ftp://ftp.ee.lbl.gov/
 Home Page:	http://ftp.ee.lbl.gov/
 Mailing List:
 Responsible:
 License:	BSD (4-clause)
 Location:	usr.sbin/traceroute
 Notes:
 Added changes from a5 -> a12 manually.
 Package:	tz
 Version:	tzcode2014j / tzdata2014j
 Current Vers:	tzcode2014j / tzdata2014j
 Maintainer:	Paul Eggert <eggert@cs.ucla.edu>
 Archive Site:	ftp://ftp.iana.org/tz/releases/
 Archive Site:	ftp://munnari.oz.au/pub/oldtz/
 Old Archive Site:	ftp://elsie.nci.nih.gov/pub/
 Home Page:	http://www.iana.org/time-zones
 Mailing List:	tz@iana.org
 Responsible:	kleink, christos, apb
 License:	Public domain
 Location:	lib/libc/time/zoneinfo, external/public-domain/tz/share
 Notes:
 Don't use src/lib/libc/time/tzcode2netbsd to prepare the source tree for import.
 Diffs are now applied by hand, since we have too many diffs (re-entrant tzcode,
 register removal) to apply. The diffs have been submitted upstream but there
 is too much inertia to apply them. Check for .gitignore files.
 For the data files, do use external/public-domain/tz/tzdata2netbsd.
 Package:	wpa_supplicant/hostapd
 Version:	2.0
 Current Vers:	2.2
 Maintainer:	Jouni Malinen <jkmaline@cc.hut.fi>
 Archive Site:	http://hostap.epitest.fi/releases/
 Home Page:	http://hostap.epitest.fi/wpa_supplicant/
 Mailing List:
 Responsible:	scw, dyoung, christos
 License:	BSD or GPLv2
 Location:	external/bsd/wpa/dist
 Notes:
 See /usr/src/external/bsd/wpa/NetBSD-upgrade for update instructions.
 Package:	XFree86
 Version:	4.5.0
 Current Vers:	4.8.0
 Maintainer:	XFree86 Project, Inc.
 Archive Site:	ftp://ftp.xfree86.org/pub/XFree86/
 Home Page:	http://www.xfree86.org/
 Mailing List:	devel@xfree86.org
 Responsible:	tron
 License:	XFree
 Location:	(xsrc)
 Notes:
 .x:
  Only X4??src-1 to X4??src-6 were imported. X4??src-7 contains postscript
  files which we don't need in our tree.
  ALL changes must be sent back to the XFree86 repository. Patches should
  be submitted back via http://bugzilla.xfree86.org.
 Package:	zlib
 Version:	1.2.3
 Current Vers:	1.2.8
 Maintainer:	Jean-loup Gailly and Mark Adler <zlib@gzip.org>
 Archive Site:	http://www.zlib.net/
 Home Page:	http://www.zlib.net/
 Mailing List:
 Responsible:	gwr, tron, christos
 License:	BSD (3-clause)
 Location:	common/dist/zlib
 Notes:
 Imported to src/common/dist/zlib and shared by the kernel and userland.
 Package:	services, protocols
 Version:	2013-02-21 (services), 2013-02-17 (protocols)
 Current Vers:	2013-11-27 (services), 2013-11-12 (protocols)
 Maintainer:	IANA
 Archive Site:	http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt (services)
 Archive Site:	http://www.iana.org/assignments/protocol-numbers/protocol-numbers.txt (protocols)
 Home Page:	http://www.iana.org/
 Mailing List:
 Responsible:	christos
 License:	None
 Location:	etc
 Notes:
 . Build package net/iana-etc
 . Add NetBSD rcsid to the generated protocols and services in the package
    work area.
 . Append the local services from the current services file.
 . Run:
 	services_mkdb -u services > /usr/src/etc/services
 	cp protocols /usr/src/etc/protocols
 . Fix protocols
    - fix manet alias to MANET; giving an alias with the same name is a no/op
    - protocol 84 is defined for as ttp and iptm, merge the two entries since
      libc getprotoent() does not read the whole file and merge in the "files"
      implementation.
 Package:	pigz
 Version:	2.3.1
 Current Vers:	2.3.1
 Maintainer:	Mark Adler <madler@alumni.caltech.edu>
 Archive Site:	http://zlib.net/pigz/
 Home Page:	http://zlib.net/pigz/
 Mailing List:	http://mail.zlib.net/mailman/listinfo/pigz-announce_zlib.net
 Responsible:	mrg, tls
 License:	zlib
 Location:	external/zlib/pigz/dist
 Notes:
 Package:	xz
 Version:	5.0.0
 Current Vers:	5.0.5 (stable) / 5.1.3alpha (devel)
 Maintainer:	Lasse Collin <lasse.collin@tukanni.org>
 Archive Site:	http://tukaani.org/xz/
 Home Page:	http://tukaani.org/xz/
 Responsible:	joerg
 License:	public-domain
 Location:	external/public-domain/xz/dist
 Notes:
 . See prepare-import script for stripping down the distribution.
 . Update configure.ac and use it to generate include/config.h.
 . Carefully check for GPL components leaked into the dist area.
 Package:	mpc
 Version:	1.0.1
 Current Vers:	1.0.1
 Maintainer:
 Archive Site:	http://www.multiprecision.org/mpc/download/
 Home Page:	http://www.multiprecision.org/mpc/
 Mailing List:	http://www.multiprecision.org/index.php?prog=mpc&page=development
 Responsible:	mrg
 License:	LGPL3
 Location:	external/lgpl3/mpc/dist
 Notes:
 Package:	mpfr
 Version:	3.1.2
 Current Vers:	3.1.2
 Maintainer:
 Archive Site:	http://www.mpfr.org/mpfr-current/
 Home Page:	http://www.mpfr.org/
 Mailing List:	http://websympa.loria.fr/wwsympa/arc/mpfr-announce
 Responsible:	mrg
 License:	LGPL3
 Location:	external/lgpl3/mpfr/dist
 Notes:
 Package:	GNU MP
 Version:	5.1.3
 Current Vers:	5.1.3
 Maintainer:	http://gmplib.org/mailman/listinfo/gmp-devel
 Archive Site:	http://gmplib.org/
 Home Page:	http://gmplib.org/
 Mailing List:	http://gmplib.org/mailman/listinfo/gmp-announce
 Responsible:	mrg
 License:	LGPL3
 Location:	external/lgpl3/gmp/dist
 Notes:
 Package:	osnet
 Version:	osnet-20100224
 Current Vers:	?
 Maintainer:	?
 Archive Site:	?
 Home Page:	?
 Mailing List:	?
 Responsible:	?
 License:	CDDL
 Location:	external/cddl/osnet
 Notes:
 Package:	sljit
 Version:	0.91 (svn revision 257)
 Current Vers:	svn revision 268
 Maintainer:	Zoltán Herczeg <hzmester@freemail.hu
 Archive Site:	http://sourceforge.net/projects/sljit/
 Home Page:	http://sljit.sourceforge.net/
 Mailing List:	none
 Responsible:	alnsn
 License:	BSD (2-clause)
 Location:	sys/external/bsd/sljit/dist
 Notes:
 		Need to feed back local changes
 Package:	tre
 Version:	0.8.0
 Current Vers:	0.8.0
 Maintainer:	http://laurikari.net/tre
 Archive Site:	http://laurikari.net/tre
 Home Page:	http://laurikari.net/tre
 Mailing List:
 Responsible:	agc, christos
 License:	BSD (2-clause)
 Location:	external/bsd/tre/dist
 Notes:
 		Need to feed back local changes
 Package:	TrouSerS
 Version:	0.3.8
 Current Vers:	0.3.8
 Maintainer:	http://trousers.sourceforge.net
 Archive Site:	http://trousers.sourceforge.net
 Home Page:	http://trousers.sourceforge.net
 Mailing List:	http://trousers.sourceforge.net
 Responsible:	christos
 License:	CPL
 Location:	crypto/external/cpl/trousers/dist
 Notes:
 		Need to feed back local changes
 Package:	tpm-tools
 Version:	1.3.7.1
 Current Vers:	1.3.7.1
 Maintainer:	http://trousers.sourceforge.net
 Archive Site:	http://trousers.sourceforge.net
 Home Page:	http://trousers.sourceforge.net
 Mailing List:	http://trousers.sourceforge.net
 Responsible:	christos
 License:	CPL
 Location:	crypto/external/cpl/tpm-tools/dist
 Notes:
 		Need to feed back local changes
 Package:	elftoolchain (libelf/libdwarf)
 Version:	FreeBSD-2014-03-08
 Current Vers:	FreeBSD-XXXX-YY-ZZ
 Maintainer:	Joseph Koshi <jkoshi@freebsd.org>
 Archive Site:	none
 Home Page:	none
 Mailing List:	none
 Responsible:	christos
 License:	BSD-like (2-clause)
 Location:	sys/external/bsd/elftoolchain/dist
 Notes:
 		Run prepare-import.sh; next time use svn id.
 Package:	smbfs
 Version:	smbfs-1.4.1.tar.gz + FreeBSD-2003-02-16
 Current Vers:	FreeBSD-XXXX-YY-ZZ
 Maintainer:	Boris Popov <bp@FreeBSD.org>
 Archive Site:	none
 Home Page:	http://people.freebsd.org/~bp/pub/smbfs/smbfs-1.4.1.tar.gz
 Mailing List:	?
 Responsible:	christos
 License:	BSD-like (4-clause)
 Location:	external/bsd/smbfs
 Notes:
 		The kernel portion has been removed from the tar file.
 		Our kernel smbfs and netsmb directories could move to
 		external, but this is just make-work.
 Package:	timeout
 Version:	FreeBSD-2014-08-01
 Current Vers:	FreeBSD-XXXX-YY-ZZ
 Maintainer:	Baptiste Daroussin <bapt@FreeBSD.org>
 Archive Site:	none
 Home Page:	none
 Mailing List:	none
 Responsible:	christos
 License:	BSD-like (2-clause)
 Location:	usr.bin/timeout

 @@ -18622,999 +18622,1022 @@ Apologies for any names omitted.
 	Bugfix (introduced: 20130512): postscreen logged no "PASS
 	NEW" event when the pregreet tests were turned off and the
 	postscreen_dnsbl_whitelist_treshold feature was turned on.
 	Reported by Rob McGee (/dev/rob0). Files: postscreen/postscreen.h,
 	postscreen/postscreen_early.c.
 	Bugfix (introduced: 20130512): postscreen panic because the
 	logic for dnsbl result retrieval was changed. Reported by
 	Noel Jones. File: postscreen/postscreen_early.c.
 20130517
 	Cleanup: just like the postscreen DNS block test will use
 	partial scores when some DNS lookup result is unavailable,
 	the postscreen_dnsbl_whitelist_treshold feature will now
 	use partial scores instead of ignoring them.  File:
 	postscreen/postscreen_early.c.
 20130518
 	Bugfix (introduced: 1997): memory leak after error while
 	forwarding mail through the cleanup server. Viktor found
 	one, Wietse eliminated the rest.  File: local/forward.c.
 	Feature: posttls-finger protocol and cipher grade selection
 	options.  Leave protocol debug flags active across reconnects,
 	only suppress redundant logging of the certificate details.
 	Viktor Dukhovni. File: posttls-finger/posttls-finger.c.
 	Robustness: send SNI even when trying to reuse a DANE
 	session, because a new session may be negotiated anyway.
 	Viktor Dukhovni. File: tls/tls_client.c.
 	Cleanup: eliminate variable that is redundant with respect
 	to more authoritative state.  Viktor Dukhovni. File:
 	posttls-finger/posttls-finger.c.
 	Feature: new tls_ssl_options parameter to enable OpenSSL
 	features (as opposed to tls_disable_workarounds which is
 	disables bug workarounds that are on by default). Viktor
 	Dukhovni. Files: proto/TLS_README.html, proto/postconf.proto,
 	src/global/mail_params.h, src/tls/tls.h, src/tls/tls_client.c,
 	src/tls/tls_misc.c.
 20130520
 	Documentation: removed resolve_null_domain from the list
 	of smtpd(8) parameters. File: smtpd/smtpd.c.
 20130523
 	Documentation: add cidr: and texthash: to the list of maps
 	that don't have automatic change detection. File:
 	proto/DATABASE_README.html.
 	Documentation: define the netmask format of CIDR maps.
 	File: proto/cidr_table.
 20130530
 	Cleanup: replace alloca() with mymalloc()/myfree() for
 	better error handling. Reported by Bill Parker. File:
 	util/dict_ni.c (does anyone still use this code?).
 20130531
 	Feature: tls_wildcard_matches_multiple_labels (default:
 	yes) to match multiple DNS labels with "*" in wildcard
 	certificates. Viktor Dukhovni. Files: proto/postconf.proto,
 	mantools/postlink, global/mail_params.h, tls/tls_client.c,
 	tls/tls_misc.c.
 20130607
 	Bugfix (DANE support): with multiple TLSA RR that carry "x
 0" certificates or "x 1 0" keys, Postfix failed to reset
 	the cert/key pointer before calling d2i_mumble(), causing
 	OpenSSL to clobber the previous cert or key.  Viktor Dukhovni.
 	tls/tls_dane.c.
 	Robustness: check that TLSA-supplied certs have valid keys.
 	It is not clear whether that check is performed in d2i().
 	Viktor Dukhovni. tls/tls_dane.c.
 20130608
 	Cleanup (DANE support): be more explicit in the logging of
 	object digests.  Viktor Dukhovni. tls/tls_dane.c.
 20100613
 	Workaround: unhelpful down-stream maintainers fail to install
 	the new smtpd_relay_restrictions safety net, causing breakage
 	that could have been avoided. We now hard-code the safety
 	net instead.  Files: global/mail_params.h, conf/post-install,
 	RELEASE_NOTES_2.10.
 	Bugfix (DANE support): when TLSA records are insecure,
 	report that none are found. Viktor Dukhovni. Files:
 	posttls-finger/posttls-finger.c, smtp/smtp_tls_policy.c,
 	tls/tls_dane.c.
 20130615
 	TLS Interoperability: turn on SHA-2 digests by force.  This
 	improves interoperability with clients and servers that
 	deploy SHA-2 digests without the required support for
 	TLSv1.2-style digest negotiation.  Based on patch by Viktor
 	Dukhovni.  Files: tls/tls_client.c, tls/tls_server.c.
 20130616
 	Workaround: The Postfix SMTP server TLS session cache was
 	broken because OpenSSL now enables session tickets by
 	default, resulting in different ticket encryption key for
 	each smtpd(8) process.  the workaround turns off session
 	tickets. In 2.11 we'll enable session tickets properly.
 	Viktor Dukhovni. File: tls/tls_server.c.
 	Updated DANE support (trust in DNS instead of PKI).  With
 	OpenSSL 1.0.2 (under development) trusted certificates don't
 	need to be self-signed roots.  Otherwise we use an ephemeral
 	root certificate to sign the trust anchor. Viktor Dukhovni.
 	Files: posttls-finger/posttls-finger.c, smtp/smtp_proto.c,
 	smtp/smtp_tls_policy.c, tls/tls.h, tls/tls_client.c,
 	tls/tls_dane.c, tls/tls_fprint.c, tls/tls_misc.c,
 	tls/tls_verify.c.
 20130619
 	Documentation: troff lint. Patch by ES Raymond's bot.  File:
 	proto/header_checks.
 	Cleanup: enforce smtpd_client_recipient_rate_limit for VRFY
 	commands. File: smtpd/smtpd.c.
 20130622
 	Bugfix: typo in the 20130613 smtpd_relay_restrictions default
 	setting. File: global/mail_params.h.
 20130623
 	Cleanup: configurable tlsmgr(8) service name. Files:
 	mantools/postlink, proto/postconf.proto, tls/tls_mgr.c,
 	tls/tls_misc.c, tlsproxy/tls-proxy.c, smtp/smtp.c,
 	smtpd/smtpd.c.
 20130629
 	Cleanup: documentation. Files: proto/CONNECTION_CACHE_README.html,
 	proto/SCHEDULER_README.html.
 20130708
 	Cleanup: postscreen_upstream_proxy_protocol setting.  Files:
 	global/mail_params.h, postscreen/postscreen_endpt.c.
 20130709
 	Cleanup: qmgr documentation clarification by Patrik Rak.
 	Files: proto/SCHEDULER_README.html, qmgr/qmgr_job.c.
 	Cleanup: re-indented code. File: qmgr/qmgr_job.c.
 	Logging: minimal DNAME support. Viktor Dukhovni.  dns/dns.h,
 	dns/dns_lookup.c, dns/dns_strtype.c, dns/test_dns_lookup.c.
 20130710
 	Workaround: smtp_connection_reuse_count_limit (default 0,
 	i.e.  unlimited) for sites that must deal with hostile
 	connection reuse policies. The documentation comes with a
 	warning that this feature introduces a "fatal attractor"
 	failure mode.  Files: global/mail_params.h, mantools/postlink,
 	proto/postconf.proto, smtp/smtp.c, smtp/smtp_params.c,
 	smtp/lmtp_params.c, smtp/smtp.h.
 	Workaround: FreeBSD9 nroff outputs ANSI escape sequences
 	instead of overstrike sequences. To make matters worse, it
 	uses the ESC[0m sequence sometimes for end-of-bold and
 	sometimes for end-of-italic.  File: mantools/man2html.
 20130714
 	Cleanup: added smtpd_relay_restrictions entries to the
 	default master.cf file, so that main.cf settings won't
 	affect the submission and smtps services. Simon Matter.
 	File: conf/master.cf.
 20130728
 	Cleanup: wrong function name in error message. John Fawcett.
 	File: util/vstring_vstream.c.
 20130801
 	Cleanup: with ``make makefiles CCARGS="-DHAS_DB...'', the
 	makedefs script no longer tries to locate the Linux Berkeley
 	DB include and library files. Instead it assumes that the
 	locations are given on the command line, as shown in the
 	DB_README examples.  Leo Baltus. File: makedefs.
 20130805
 	Documentation: clarified reject_non_fqdn_helo_hostname.
 	File: proto/postconf.proto.
 20130809
 	Cleanup: the lmdb_map_size parameter is now a long integer.
 	Howard Chu. Files: global/mail_params.[hc].
 20130815
 	Documentation: added pointer to Dovecot 2 configuration.
 	File: proto/SASL_README.html
 20130818
 	Update: LMDB client updated to LMDB 0.9.7, which hopefully
 	fixes the unrecoverable "transaction full" error. With a
 	new MDB_MAP_FULL workaround by Howard Chu that ensures that
 	postfix will make progress as long as the disk is not full.
 	File: util/dict_lmdb.c.
 20130822
 	The status of LMDB databases is "not recommended".  Unlike
 	other Postfix databases, LMDB does not grow beyond a specified
 	limit even when the file system has room.  This show-stopper
 	bug breaks applications whose requirements grow with load:
 	postscreen(8), greylisting, tlsmgr(8) and verify(8).
 20130825
 	Bitrot: Arrange for shared keys in SMTP server session
 	tickets.  Otherwise, with clients that enable session
 	tickets, the SMTP session cache is per-process and largely
 	ineffective.  Older releases should add SSL_OP_NO_TICKET
 	to the SSL options bit mask in the SMTP server only.  The
 	session ticket key validity interval (sum of initial issuing
 	and retired key validation intervals) must not exceed the
 	SSL session lifetime.  Otherwise, clients may send valid
 	tickets for expired sessions, which the OpenSSL server code
 	mishandles (does not send a replacement ticket, patch
 	pending...).
 	We set the session lifetime to 2 times the configured cache
 	lifetime which is also the ticket issuing and retired
 	validation lifetime, so ticketed sessions last 1 to 2 times
 	the configured session lifetime and never longer than a
 	session's expiration time.
 	Code by Viktor Dukhovni.  Files: .indent.pro, mantools/postlink,
 	proto/TLS_README.html, proto/postconf.proto, global/mail_params.h,
 	posttls-finger/posttls-finger.c, posttls-finger/tlsmgrmem.c,
 	smtpd/smtpd.c, tls/tls.h, tls/tls_client.c, tls/tls_mgr.c,
 	tls/tls_mgr.h, tls/tls_scache.c, tls/tls_scache.h,
 	tls/tls_server.c, tlsmgr/tlsmgr.c, tlsproxy/tlsproxy.c.
 	Robustness: Search for TLSA RRs at the resolved server name
 	(rname) and failing that request server name (qname), and
 	use whichever was found as the TLSA base domain for certificate
 	matching.
 	When we find a DNSSEC validated MX RRset, and the initial
 	next-hop domain is a CNAME, include both the initial and
 	final (the one with the actual MX RRs) domains in the list
 	of valid server certificate names.
 	When we find no MX records, then the initial next-hop domain
 	is obtained securely from the recipient domain or transport
 	next-hop.  Without MX records, this is a destination hostname,
 	so we should generally do a TLSA lookup.  If however the
 	address lookup yields an insecure result, and its rname is
 	equal to its qname (no CNAMEs), we reasonably assume that
 	the its child "_port._tcp" sub-domain is likewise insecure
 	(security here would require DLV just for this sub-domain).
 	This allows us to skip futile TLSA queries for most non-MX
 	destinations (those that are in insecure zones and are not
 	CNAMEs).  This heuristic can be disabled by setting the new
 	main.cf parameter smtp_tls_force_insecure_host_tlsa_lookup
 	to "yes", the default is "no".
 	Finally, with MX hostnames, if the MX RRset is secure, we
 	look for TLSA RRs at the qname only when the MX host is an
 	alias with an insecure rname.  If both the qname and the
 	rname are secure, as before we prefer the rname, but when
 	nothing is found there, fall back to the qname.
 	Code by Viktor Dukhovni. Files: mantools/postlink,
 	proto/postconf.proto, src/global/mail_params.h,
 	src/posttls-finger/posttls-finger.c, src/smtp/lmtp_params.c,
 	src/smtp/smtp.c, src/smtp/smtp.h, src/smtp/smtp_addr.c,
 	src/smtp/smtp_addr.h, src/smtp/smtp_connect.c,
 	src/smtp/smtp_params.c, src/smtp/smtp_tls_policy.c,
 	src/tls/tls.h, src/tls/tls_dane.c.
 20130826
 	Documentation: re-ordered STRESS_README, now that all
 	supported releases have stress-adaptive behavior built in.
 	File: proto/STRESS_README.html.
 20130903
 	Cleanup: made the default_database_type compile-time
 	configurable. Files: util/sys_defs.h, makedefs, proto/INSTALL.
 20130916
 	Feature: reject_known_sender_login_mismatch, which applies
 	reject_sender_login_mismatch only to MAIL FROM addresses
 	that are known in $smtpd_sender_login_maps. Viktor & Wietse.
 	Files: mantools/postlink, proto/SASL_README.html,
 	proto/postconf.proto, global/mail_params.h, smtpd/smtpd_check.c.
 20130927
 	Cleanup: no more LMDB "database full" errors.  Postfix now
 	requires LMDB >= 0.9.8 which supports on-the-fly database
 	resizing. When a database becomes full, its size limit is
 	automatically doubled, and other processes automatically
 	pick up the new database size limit.  Files: util/dict.h,
 	util/dict_open.c, util/dict_alloc.c, util/dict_lmdb.c,
 	postmap/postmap.c, postalias/postalias.c, proto/LMDB_README.html,
 	proto/postconf.proto.
 20130928
 	Cleanup: the lmdb_max_readers property is now configurable.
 	This is a hard limit built into the OpenLDAP library that
 	causes requests to fail when the number of open read
 	transactions exceeds the limit.  When this happens the LMDB
 	client logs an MDB_READERS_FULL warning and continues with
 	reduced performance.  Files: util/dict_lmdb.c, util/dict_lmdb.h,
 	global/mail_params.h, global/mail_params.c, proto/postconf.proto,
 	proto/LMDB_README.html.
 20130929
 	Security violation: LMDB opens files with read/write access
 	for lock management purposes.  This gives unprivileged
 	daemon processes read/write file handles for root-owned
 	files under /etc/postfix.  This also breaks when a non-root
 	process needs to access a root-owned database.  Even if
 	LMDB lock files were world-writable, and kept in a dedicated
 	directory, they would still violate the principle of least
 	privilege. For all these reasons, support to create LMDB
 	files is removed from the postmap and postalias commands.
 	LMDB files can still be created by unprivileged Postfix
 	daemon processes under the postfix-owned data_directory.
 	Files: proto/LMDB_README.html, global/mkmap.c.
 20131001
 	Cleanup: LMDB support is forbidden due to problems with
 	LMDB lock management. These problems hinder error recovery
 	in multi-programmed systems, and prohibit database sharing
 	between privileged writer processes and unprivileged reader
 	processes.
 20131009
 	Documentation: inet_protols description was not updated
 	when smtp_address_preference was added. File: proto/postconf.proto
 20131013
 	Documentation: why postscreen(8) uses hash-table lookups
 	instead of direct pointers to find the DNSBL lookup result
 	for a specific session. File: postscreen/postscreen_early.c.
 20131022
 	Cleanup: add more &code; to postconf2man. Someone has been
 	writing documentation without checking the result, File:
 	mantools/postconf2man.
 	Documentation: in the discard(8) manpage, the reason is not
 	a host or domain name. File: discard/discard.c.
 20131025
 	Documentation: specify the expected result format with
 	"list" tables. File: proto/DATABASE_README.html.
 20131026
 	Future proofing: API changes in the PCRE library.  File:
 	util/dict_pcre.c.
 20131028
 	Feature: check_sasl_access to block hijacked logins.  Files:
 	mantools/postlink, proto/postconf.proto, global/mail_params.h,
 	smtpd/smtpd_check.c, smtpd/smtpd_dsn_fix.h.
 20131029-31
 	Cleanup: slmdb(3) simplified LMDB API that hides recoverable
 	LMDB errors from applications so that they can focus on
 	their own job. Files: util/slmdb.[hc].
 	Cleanup: LMDB functionality restored, after elimination of
 ) world-writable lockfiles, 2) hard limits on the number
 	of concurrent readers, and 3) hard-coded database file inode
 	numbers in lockfiles that can prevent automatic crash
 	recovery.  Files: proto/LMDB_README.html, proto/postconf.proto,
 	mantools/postlink, util/dict_lmdb.c.
 20131101
 	Cleanup: restore ability to build without LMDB support;
 	further slmdb API streamlining. Files: util/slmdb.[hc],
 	util/dict_lmdb.c.
 	Bugfix: uninitialized variable. File: util/slmdb.c.
 	Documentation: added SASL_README example for check_sasl_access.
 	File: proto/SASL_README.html.
 20131102-3
 	Security violation: by default, LMDB 0.9.9 writes uninitialized
 	heap memory to a world-readable database file, as chunks
 	of up to 4096 bytes.  This is a huge memory disclosure
 	vulnerability: memory content that a program does not intend
 	to share ends up in a world-readable file.  The content of
 	uninitialized heap memory depends on program execution
 	history. That history includes code execution in other
 	libraries that are linked into the program.
 	This is a problem whenever the user who writes the database
 	file differs from the user who reads the database file. For
 	example, a privileged writer and an unprivileged reader.
 	In the case of Postfix, the postmap(1) and postalias(1)
 	commands would leak uninitialized heap memory, as chunks
 	of up to 4096 bytes, from a root-privileged process that
 	writes to a database file, to unprivileged processes that
 	read from that database file.
 	To work around this problem the postmap(1) and postalias(1)
 	commands disable the use of malloc() in LMDB. However, that
 	does not address several disclosures of stack memory.  Other
 	Postfix databases do not need this workaround: those databases
 	are maintained by Postfix daemon processes, and are accessible
 	only by the postfix user. File: util/dict_lmdb.c.
 20131102-3
 	Cleanup: expand TAB characters when generating documentation.
 	This was primarily an issue with non-HTML output, but it does
 	not hurt to do this also for HTML.  Files: proto/Makefile.in,
 	proto/MULTI_INSTANCE_README.html.
 20131104
 	Feature: ${queue_id} macro support for the pipe(8) delivery
 	agent by Andreas Schulze. File: pipe/pipe.c.
 20131107
 	Cleanup: after 16 years the SKIP() and TRIM() macros were
 	triggering compiler warnings.  Files: global/mail_params.c,
 	smtpstone/smtp-sink.c, util/mac_parse.c, util/split_nameval.c.
 20131110
 	Bugfix (introduced Oct 26 1997): don't clobber errno before
 	expanding %m. File: util/vbuf_print.c.
 20131114
 	Cleanup: LMDB >= 0.9.10 does not need the MDB_WRITEMAP
 	workaround to avoid heap memory information leaks.  File:
 	util/dict_lmdb.c.
 20131114
 	Cleanup: Coverity found a harmless memory leak in the
 	postconf master.cf parser.  Reported by Christos Zoulas,
 	NetBSD.  File: postconf/postconf_master.c.
 	Cleanup: graceful degradation after database open() error.
 	Several instances of that code introduced a harmless memory
 	leak, and Coverity complained about one of them (Christos
 	Zoulas, NetBSD).  Instead of adding random code in random
 	places, restructured dict_foo_open() routines with consistent
 	code to dispose of memory or file handles. Files: dict_thash.c,
 	dict_sockmap.c, dict_regexp.c, dict_pcre.c, dict_lmdb.c,
 	dict_dbm.c, dict_cidr.c, dict_cdb.c.
 	Cleanup: warning message after canonical/virtal/etc.
 	table lookup error. Files: cleanup/cleanup_addr.c,
 	cleanup/cleanup_map11.c, cleanup/cleanup_map1n.c,
 	cleanup/cleanup_masquerade.c, cleanup/cleanup_message.c,
 	cleanup/cleanup_milter.c.
 20131116
 	Feature: MySQL client support for option_file, option_group,
 	tls_cert_file, tls_key_file, tls_CAfile, tls_CApath,
 	tls_verify_cert. See mysql_table(5).  Code by Gareth Palmer.
 	Files: proto/mysql_table, global/dict_mysql.c.
 	Cleanup: DANE support. Keep the attributes of TA certificates
 	obtained via "IN TLSA 2 0 X" RRs, while continuing to only
 	use the key from "IN TLSA 2 1 X" RRs.  This means in the
 	"2 0 X" case that we re-sign the TA certificate in place,
 	rather than synthesize a vanilla cert around just the key.
 	Viktor Dukhovni. File: tls/tls_dane.c.
 	Bugfix: posttls-finger parsing of destination and optional
 	match values. Viktor Dukhovni.  File:
 	posttls-finger/posttls-finger.c.
 	Cleanup: When wrap_signed is false (OpenSSL 1.0.2 some day),
 	we don't have to sign trust anchors, and don't generate a
 	key to do so.  Thus don't attempt to re-sign trust-anchor
 	certificates (IN TLSA 2 0 X) in this case. Viktor Dukhovni.
 	File: tls/tls_dane.c.
 	Feature: configurable DANE digest algorithm priority. Use
 	only the most-preferred, shared, digest algorithm for any
 	give (usage, selector) combination. Viktor Dukhovni.
 	mantools/postlink, proto/postconf.proto, global/mail_params.h,
 	tls/tls_dane.c, tls/tls_misc.c.
 	Bugfix: FreeBSD nroff workaround messed up. File:
 	mantools/postlink.
 20131118
 	Cleanup: FreeBSD nroff workaround. Files: man/Makefile.in,
 	proto/Makefile.in.
 	Cleanup: the smtpd_proxy_filter client now sends QUIT before
 	closing the connection to a content filter.  Files:
 	smtpd/smtpd_proxy.c, smtpd/smtpd.c.
 	Portability: C99 va_copy() compatibility, in case some
 	implementation does not permit multiple va_start() calls
 	on the same argument list. Files: global/memcache_proto.c,
 	milter/milter8.c, smtpstone/smtp-source.c, util/attr_clnt.c,
 	util/concatenate.c, util/dict_surrogate.c, util/netstring.c,
 	util/compat_va_copy.h.
 	Cleanup: comment formatting. Viktor Dukhovni. File: dns/dns.h.
 	Cleanup: removed redundant sort operation. Viktor Dukhovni.
 	File: tls/tls_dane.c.
 20131119
 	Feature: a Postfix LMDB database can now be used as shared
 	persistent cache with multiple postscreen(8) or verify(8)
 	daemons (but not both), without the need for a shared
 	proxymap server.  Files: util/dict.h, util/dict_alloc.c,
 	util/dict_open.c, util/dict_lmdb.c.
 	Internal: DNS client support to report reply RCODE information,
 	in addition to the simplified DNS_NOTFOUND, DNS_RETRY etc.
 	Portability note: this requires the C99 __VA_ARGS__ feature.
 	Files: dns/dns.h. dns/dns_lookup.c, dns/test_dns_lookup.c.
 20131120
 	Cleanup: reduced the code footprint for the LMDB < 0.9.10
 	heap-to-file information leak workaround, and simplified
 	the implementation to "good enough". Files: util/dict.h,
 	util/dict.c, util/dict_lmdb.c, postalias/postalias.c,
 	postmap/postmap.c.
 	Cleanup: reduced the code footprint for the handling of
 	multi-writer safe maps. A map only needs to assert that it
 	is multi-writer safe, and the rest just happens.  Files:
 	util/dict.h, util/dict_open.c, util/dict_lmdb.c,
 	global/dict_memcache.c.
 	Cleanup: Postfix daemons no longer restart when a multi-writer
 	safe map is updated. File: util/dict.c.
 	Documentation: sharing an LMDB cache between multiple
 	verify(8) or postscreen(8) servers (but not both).  Files:
 	proto/ADDRESS_VERIFICATION_README.html,
 	proto/POSTSCREEN_README.html.
 	Cleanup: improve suppression of TLSA lookups in insecure
 	zones.  This is now applied not only to non-MX destinations,
 	but also to each MX record.  Viktor Dukhovni. Files:
 	src/posttls-finger/posttls-finger.c, src/smtp/smtp_tls_policy.c,
 	src/tls/tls.h, src/tls/tls_dane.c.
 	Workaround: increased the 5s connection timeout to 30s.
 	Viktor Dukhovni. File: posttls-finger/posttls-finger.c.
 20131121
 	Documentation: new socketmap_table(5) and lmdb_table(5)
 	manpages.  Files: mantools/postlink, conf/postfix-files,
 	html/Makefile.in, man/Makefile.in, proto/DATABASE_README.html,
 	postconf/postconf.c, proto/socketmap_table, proto/lmdb_table.
 20131122
 	Documentation: missing database hyperlinks, refined text
 	about partial lookup keys. Files: mantools/postlink,
 	proto/DATABASE_README.html, proto/lmdb_table,
 	proto/socketmap_table.
 20131123
 	Feature: support for NOTIFY parameter in the Milter
 	SMFIR_ADDRCPT_PAR request. Contributed by by Andrew Ayer.
 	Wietse added support for ORCPT.  Files: cleanup/cleanup.h,
 	cleanup/cleanup_milter.c, cleanup/cleanup_state.c,
 	global/xtext.c, global/xtext.h, milter/test-milter.c.
 20131122
 	Feature: "postconf -Fe service/type/attribute = value" edits
 	master.cf attribute values. The -e is optional. Example:
 	use "postconf -F "*/*/chroot = n" to turn off chroot on all
 	master.cf services. Files: postconf/postconf.h,
 	postconf/postconf.c, postconf/postcof_master.c,
 	postconf/postconf_edit.c.
 20131124
 	Cleanup: remove extra blank line from ccformat output,
 	making it compatible with the script that Wietse actually
 	uses (this line was part of a test to detect file truncation,
 	but it is now obsolete).  File: mantools/ccformat.
 	Feature: master.cf parameter namespace. "postconf -P" shows
 	master.cf parameter settings as "service/type/parameter =
 	value". This is applicable only to parameter settings in
 	master.cf. Files: postconf/postconf.h, postconf/postconf.c,
 	postconf/postcof_master.c, postconf/postconf_print.c.
 	Incompatibility: the master_service_disable syntax has
 	changed: use "service/type" instead of "service.type".  The
 	new form is consistent with master.cf parameter namespaces.
 	The old form is still supported to avoid breaking existing
 	configurations.  Files: global/master_service.c,
 	master/master_ent.c.
 20131125
 	Feature: change, add or delete "-o parameter=value" setting
 	in master.cf. Examples: "postconf -P smtp/inet/parameter=value"
 	(add or modify "-o name=value" setting) and "postconf -P
 	smtp/inet/parameter" (delete "-o parameter=value" setting).
 	Files: util/argv.[hc], postconf/postconf.h,
 	postconf/postconf_edit.c, postconf_master.c.
 20131126
 	Cleanup: Leave SSLv3 enabled with DANE. Viktor Dukhovni.
 	Files: proto/TLS_README.html proto/postconf.proto
 	tls/tls_client.c.
 	Cleanup: DANE support: Drop support for usage 0. It SHOULD
 	NOT be supported in DANE with SMTP, and we already don't
 	support digest TLSA RRs in this case, while full content
 	TLSA RRs are not recommended for DNS bloat reasons.  Viktor
 	Dukhovni. Files: proto/postconf.proto src/global/mail_params.h
 	src/smtp/smtp.c src/tls/tls_dane.c src/tls/tls_misc.c.
 	Feature: TLS support: Support future digest algorithms
 	without re-compilation. Viktor Dukhovni. Files: .indent.pro
 	proto/postconf.proto src/tls/tls_dane.c.
 	Feature: DNS support: New configurable digest agility.
 	Viktor Dukhovni. Files: .indent.pro proto/TLS_README.html
 	proto/postconf.proto src/global/mail_params.h src/tls/tls_dane.c
 	src/tls/tls_misc.c.
 20131127
 	Bugfix (introduced: 20090106): the postconf '-#' option
 	erased prior options. File: postconf/postconf.c.
 20131129
 	Bugfix: Makefile example in MULTI_INSTANCE_README. Viktor
 	Dukhovni. File: proto/MULTI_INSTANCE_README.html.
 20131130
 	Cleanup: simplify fingerprint security level implementation
 	in new DANE code.  Viktor Dukhovni.  Files: src/tls/tls.h
 	src/smtp/smtp_tls_policy.c src/tls/tls_dane.c
 	src/posttls-finger/posttls-finger.c.
 20131209
 	Cleanup: safe_strtoul() did not report an error for empty
 	or all-space input (the code to report this was in the wrong
 	place). This was not a problem as long as safe_strtoul()
 	was used only for output from safe_ultostr().  Files:
 	global/safe_ultostr.c, global/safe_ultostr.in,
 	global/safe_ultostr.ref.
 20131210
 	Documentation: updated description of SSL protocol controls.
 	In particular, enabled protocols are part of a contiguous
 	range. Viktor Dukhovni.  Files: proto/TLS_README.html,
 	proto/postconf.proto.
 	Bugfix: DANE support: handle OpenSSL memory allocation
 	error. Viktor Dukhovni.  File: tls/tls_dane.c.
 	Cleanup: LMDB_README was not installed. File: conf/postfix-files.
 20131214
 	Portability: on some platforms posttls-finger now requires
 	explicitly linking libdl.  File: posttls-finger/Makefile.in.
 	Cleanup: DANE support: extension gymnastics. Viktor Dukhovni.
 	File: tls/tls_dane.c.
 	Bugfix: DANE support: the wrap_cert() and wrap_key() calls
 	should never fail, but some callers ignored the return
 	value.  The only failure is for lack of memory, so we use
 	msg_fatal() internally and change wrap_cert() and wrap_key()
 	to return void. Viktor Dukhovni.  File: tls/tls_dane.c.
 	Bugfix: DANE support: avoid making DANE certificates with
 	replaced public-keys appear as if they were self-signed.
 	Viktor Dukhovni.  File: tls/tls_dane.c.
 	Cleanup: DANE support: simplify grow_chain() to always apply
 	trust consistently. Viktor Dukhovni.  File: tls/tls_dane.c.
 	Bugfix: DANE support: backport fixes from OpenSSL DANE
 	testing.  Discard errors generated by raw TA key signature
 	checks. Record the tadepth as zero with self-signed depth
 TAs. Robustness: Though it should never happen, don't
 	update the tadepth if already set. Viktor Dukhovni.  Files:
 	tls/tls_dane.c, tls/tls_server.c.
 20131215
 	Cleanup: OpenSSL "const" declarations have changed over
 	time. Viktor Dukhovni. Files: src/tls/tls.h, src/tls/tls_client.c,
 	src/tls/tls_dane.c, src/tls/tls_server.c.
 20131216
 	Cleanup: TLS support. Eliminate calls of deprecated functions
 	before they are removed from OpenSSL.  CRYPTO_thread_id is
 	deprecated and we don't need it.  Replace the deprecated
 	ERR_remove_state() call with ERR_remove_thread_state(), and
 	use RSA_generate_key_ex().  Viktor Dukhovni. Files:
 	posttls-finger/posttls-finger.c, tls/tls_misc.c, tls/tls_rsa.c.
 	Cleanup: DANE support: Reduce #ifdef clutter to improve
 	redability and maintability. Viktor Dukhovni.  File:
 	tls/tls_dane.c.
 	Future proofing: Tolerate disappearance of named bug-workaround
 	bits without invalidating user configurations.  When support
 	for a bug workaround is removed from OpenSSL, the corresponding
 	bit is defined as zero (i.e. NOOP) intstead of causing
 	programs to break. Viktor Dukhovni.  File: tls/tls_misc.c.
 20131217
 	Portability: RSA_generate_key_ex() is not available on all
 	supported platforms, so this change is made conditional.
 	Enforce that this function will be used only for creating
 	a 512-bit ephemeral RSA key.  Viktor Dukhovni. File:
 	tls/tls_rsa.c.
 20131218
 	Documentation: new document FORWARD_SECRECY_README that
 	describes how different versions of Postfix >= 2.2 implement
 	"perfect" forward secrecy. Viktor Dukhovni. File:
 	proto/FORWARD_SECRECY_README.html, proto/Makefile.in,
 	conf/postfix-files, html/index.html.
 20131219
 	Cleanup: renamed postconf(1) internal identifiers according
 	to a consistent scheme, to avoid future name conflicts as
 	Postfix evolves. This is a no-feature change.  Files:
 	postconf/*.[hc], postconf/extract.awk.
 	Documentation: linearized the order of exposition in
 	FORWARD_SECRECY_README. File: proto/FORWARD_SECRECY_README.html.
 20131220
 	Bugfix: DANE support: segfault. Viktor Dukhovni. File:
 	tls/tls_dane.c.
 	Documentation: typo in SASL_README. Patrick Ben Koetter.
 	File: proto/SASL_README.html.
 	Documentation: increased the *.[0-9].html manpage width
 	from the historical 65 columns to the more contemporary 78
 	columns, and future-proofed the pattern that eliminates
 	redundant text from the "README FILES" section.  Files:
 	mantools/postlink, mantools/man2html, man/Makefile.in.
 	Documentation: misc manual page cleanups. Files:
 	postconf/postconf.c, postmulti/postmulti.c.
 20131221
 	Testbed: TLS support. Viktor Dukhovni. Files: tls/Makefile.in,
 	tls/tls_dane.c, tls/tls_dane.sh, tls/tls_mgr.c, .indent.pro.
 	Documentation: added section on how to verify that forward
 	secrecy works. File: proto/FORWARD_SECRECY_README.html.
 20131222
 	Documentation: forward secrecy, with feedback from Adam
 	Shostack.  Viktor Dukhovni and Wietse Venema. File:
 	proto/FORWARD_SECRECY_README.html.
 20131224
 	Feature: smtpd_sasl_service (until now, this was hard-coded
 	internally as "smtp"). On request by Michal (sksoft.cz).
 	Files: global/mail_params.h, proto/postconf.proto,
 	mantools/postlink, smtpd/smtpd.c, smtpd/smtpd_sasl_glue.c.
 	Documentation: updated example to Dovecot version 2 syntax.
 	File: proto/SASL_README/html.
 20131228
 	Cleanup: DANE support: test script. Viktor Dukhovni. File
 	tls/tls_dane.sh.
 	Debugging: test driver for LMDB debugging and stress testing.
 	Shockingly, LMDB terminates the postscreen daemon without
 	logfile record.  File: util/dict_cache.c.
 20140102
 	Bugfix: close the LMDB database cursor's read transaction
 	before writing with MDB_NOLOCK and before changing the
 	database memory map size. File: util/slmdb.c.
 20140103
 	Cleanup: eliminated data duplication from the new SMTP_ITERATOR
 	structure to the old SMTP_SESSION structure. The SMTP_ITERATOR
 	structure now maintains the sole copy. Files: smtp/smtp.h,
 	smtp_sasl_auth_cache.c, smtp_reuse.c, smtp_sasl_glue.c,
 	smtp_rcpt.c, smtp_session.c, smtp_chat.c, smtp_proto.c,
 	smtp_connect.c.
 20140104
 	Feature: support for optional configuration files
 	"$daemon-directory/postfix-files.d/*".  These are processed
 	in sorted order after "$daemon-directory/postfix-files",
 	This avoids breaking "postfix set-permissions" etc. when a
 	Postfix distribution comes in multiple packages.  File:
 	conf/post-install.
 20140107
 	Feature: LMDB 0.9.11 allows Postfix daemons to log an LMDB
 	error message, instead of falling out of the sky without
 	any notification.  Files: util/slmdb.[hc], util/dict_lmdb.c.
 20140108
 	Bugfix: every Postfix LMDB transaction is now protected by
 	an external lock for its entire life time. File: util/slmdb.c.
 20140109
 	Cleanup: turn off DNSSEC lookup after CNAME redirection to
 	an insecure zone. This is an optimization for resolvers
 	that do not automatically resolve CNAME chains. Viktor
 	Dukhovni. File: dns/dns_lookup.c.
 	Cleanup: do not salt the SMTP TLS policy lookup cache key
 	with the DNSSEC status. The DNSSEC status will not change
 	when the same nexthop/host pair is looked up repeatedly.
 	Viktor Dukhovni. File: smtp/smtp_tls_policy.c.
 	Robustness: Suppress TLSA lookups only when the qname zone
 	is insecure, not just because the rname zone is insecure.
 	This requires an extra T_CNAME lookup for the qname, since
 	nameservers are often "too helpful" and report CNAME records
 	together with the CNAME targets. When the targets are
 	insecure the whole reply is marked as insecure.  Viktor
 	Dukhovni.  File: tls/tls_dane.c.
 	Cleanup: Unify/simplify reporting of configuration or other
 	conditions that prevent DANE security.  Viktor Dukhovni.
 	Files: global/dsn_buf.[hc], tls/tls_dane.c, smtp/smtp_tls_policy.c.
 20140110-15
 	Miscellaneous documentation cleanups.
 20140116
 	Workaround: prepend "-I. -I../../include" to CCARGS, to
 	avoid name clashes with non-Postfix header files. File:
 	makedefs.
 20140125
 	Cleanup: postconf(1) manpage missing version attribution
 	and incorrect "author" formatting. File: postconf/postconf.c.
 20140223
 	Logging: the TLS client logged that an "Untrusted" TLS
 	connection was established instead of "Anonymous".  Viktor
 	Dukhovni. File: tls/tls_client.c.
 20140227
 	Bugfix: Enforce TLS when TLSA records exist, but all are
 	unusable; Don't leak dane handle when all TLSA records are
 	unusable.  Viktor Dukhovni. File: smtp/smtp_tls_policy.c.
 	Cleanup: log TLS policy lookup errors as warnings. Viktor
 	Dukhovni.  File: smtp/smtp_connect.c.
 20140407
 	Documentation: the documentation for Postfix > 2.8 TLS
 	activity logging was incorrect. Loglevel 0 produces no
 	logging. Instead, information is logged only with loglevel
 or higher. Viktor Dukhovni. Files: proto/TLS_README.html,
 	proto/postconf.proto.
 20140507
 	Bugfix (introduced: Postfix 2.11): with connection caching
 	enabled (the default), recipients could be given to the
 	wrong mail server.  Root cause: due to an incorrect predicate,
 	the Postfix SMTP client could save and restore plaintext
 	connections that should not be cached, under nonsensical
 	lookup keys that did not distinguish by destination.  Problem
 	reported by Sahil Tandon, predicate error found by Viktor,
 	redundant connection restore request eliminated by Wietse.
 	File: smtp/smtp_connect.c.
 20140619
 	Bugfix (introduced: 2001): qmqpd null pointer bug when it
 	logs a lost connection while not in a mail transaction.
 	Reported by Michal Adamek. File: qmqpd/qmqpd.c.
 20140920
 	Bugfix (introduced: 20080212): incorrect client name in
 	reject messages from check_reverse_client_hostname_access
 	and check_reverse_client_hostname_{mx,ns}_access.  They
 	replied with the verified client name, instead of the name
 	that was rejected.  Problem reported by Reindl Harald. File:
 	smtpd/smtpd_check.c.
 20141012
 	Bugfix (introduced: Postfix 2.3): the PREPEND access/policy
 	action added headers ABOVE Postfix's own Received: header,
 	exposing Postfix's own Received: header to Milters (protocol
 	violation) and hiding the PREPENDed header from Milters.
 	The latter caused problems for DMARC implementations with
 	SPF policy plus DKIM Milter.  PREPENDed headers are now
 	added BELOW Postfix's own Received: header and remain visible
 	to Milters. File: smtpd/smtpd.c.
 20141014
 	Portability: Darwin 11.x needs to link with -lresolv. Viktor
 	Dukhovni. File: makedefs.
 20141018
 	Bugfix (introduced: Postfix 2.3): when a Milter inserted a
 	header ABOVE Postfix's own Received: header, Postfix would
 	expose its own Received: header to Milters (violating
 	protocol) and hide the Milter-inserted header from Milters
 	(wtf).  Files: cleanup/cleanup.h, cleanup/cleanup_message.c,
 	cleanup/cleanup_state.c, milter/milter.[hc], milter/milter8.c.
 	Cleanup: revert the workaround that places headers inserted
 	with PREPEND actions or policy requests BELOW Postfix's own
 	Received: message header. File: smtpd/smtpd.c.
 20141025
 	Bugfix (introduced: Postfix 2.11): core dump when
 	smtp_policy_maps specifies an invalid TLS level. Viktor
 	Dukhovni. File: smtp/smtp_tls_policy.c.
 20150106
 	Robustness: don't segfault due to excessive recursion after
 	a faulty configuration runs into the virtual_alias_recursion_limit.
 	File: global/tok822_tree.c.
 20150115
 	Safety: stop aliasing loops that exponentially increase the
 	address length with each iteration. Back-ported from Postfix
 .0. File: cleanup/cleanup_map1n.c.
 20150117
 	Cleanup: missing " in \%s\" in postconf(1) fatal error
 	messages. Iain Hibbert. File: postconf/postconf_master.c.

 @@ -1,1003 +1,1003 @@
-/*	$NetBSD: postconf_master.c,v 1.3 2014/07/06 19:45:50 tron Exp $	*/
+/*	$NetBSD: postconf_master.c,v 1.3.2.1 2015/03/03 07:11:08 snj Exp $	*/
 /*++
 /* NAME
 /*	postconf_master 3
 /* SUMMARY
 /*	support for master.cf
 /* SYNOPSIS
 /*	#include <postconf.h>
 /*
 /*	const char pcf_daemon_options_expecting_value[];
 /*
 /*	void	pcf_read_master(fail_on_open)
 /*	int	fail_on_open;
 /*
 /*	void	pcf_show_master_entries(fp, mode, service_filters)
 /*	VSTREAM	*fp;
 /*	int	mode;
 /*	char	**service_filters;
 /*
 /*	void	pcf_show_master_fields(fp, mode, n_filters, field_filters)
 /*	VSTREAM	*fp;
 /*	int	mode;
 /*	int	n_filters;
 /*	char	**field_filters;
 /*
 /*	void	pcf_edit_master_field(masterp, field, new_value)
 /*	PCF_MASTER_ENT *masterp;
 /*	int	field;
 /*	const char *new_value;
 /*
 /*	void	pcf_show_master_params(fp, mode, argc, **param_filters)
 /*	VSTREAM	*fp;
 /*	int	mode;
 /*	int	argc;
 /*	char	**param_filters;
 /*
 /*	void	pcf_edit_master_param(masterp, mode, param_name, param_value)
 /*	PCF_MASTER_ENT *masterp;
 /*	int	mode;
 /*	const char *param_name;
 /*	const char *param_value;
 /* AUXILIARY FUNCTIONS
 /*	const char *pcf_parse_master_entry(masterp, buf)
 /*	PCF_MASTER_ENT *masterp;
 /*	const char *buf;
 /*
 /*	void	pcf_print_master_entry(fp, mode, masterp)
 /*	VSTREAM *fp;
 /*	int mode;
 /*	PCF_MASTER_ENT *masterp;
 /*
 /*	void	pcf_free_master_entry(masterp)
 /*	PCF_MASTER_ENT *masterp;
 /* DESCRIPTION
 /*	pcf_read_master() reads entries from master.cf into memory.
 /*
 /*	pcf_show_master_entries() writes the entries in the master.cf
 /*	file to the specified stream.
 /*
 /*	pcf_show_master_fields() writes name/type/field=value records
 /*	to the specified stream.
 /*
 /*	pcf_edit_master_field() updates the value of a single-column
 /*	or multi-column attribute.
 /*
 /*	pcf_show_master_params() writes name/type/parameter=value
 /*	records to the specified stream.
 /*
 /*	pcf_edit_master_param() updates, removes or adds the named
 /*	parameter in a master.cf entry (the remove request ignores
 /*	the parameter value).
 /*
 /*	pcf_daemon_options_expecting_value[] is an array of master.cf
 /*	daemon command-line options that expect an option value.
 /*
 /*	pcf_parse_master_entry() parses a (perhaps multi-line)
 /*	string that contains a complete master.cf entry, and
 /*	normalizes daemon command-line options to simplify further
 /*	handling.
 /*
 /*	pcf_print_master_entry() prints a parsed master.cf entry.
 /*
 /*	pcf_free_master_entry() returns storage to the heap that
 /*	was allocated by pcf_parse_master_entry().
 /*
 /*	Arguments
 /* .IP fail_on_open
 /*	Specify FAIL_ON_OPEN if open failure is a fatal error,
 /*	WARN_ON_OPEN if a warning should be logged instead.
 /* .IP fp
 /*	Output stream.
 /* .IP mode
 /*	Bit-wise OR of flags. Flags other than the following are
 /*	ignored.
 /* .RS
 /* .IP PCF_FOLD_LINE
 /*	Wrap long output lines.
 /* .IP PCF_SHOW_EVAL
 /*	Expand $name in parameter values.
 /* .IP PCF_EDIT_EXCL
 /*	Request that pcf_edit_master_param() removes the parameter.
 /* .RE
 /* .IP n_filters
 /*	The number of command-line filters.
 /* .IP field_filters
 /*	A list of zero or more service field patterns (name/type/field).
 /*	The output is formatted as "name/type/field = value".  If
 /*	no filters are specified, pcf_show_master_fields() outputs
 /*	the fields of all master.cf entries in the specified order.
 /* .IP param_filters
 /*	A list of zero or more service parameter patterns
 /*	(name/type/parameter).  The output is formatted as
 /*	"name/type/parameter = value".  If no filters are specified,
 /*	pcf_show_master_params() outputs the parameters of all
 /*	master.cf entries in sorted order.
 /* .IP service_filters
 /*	A list of zero or more service patterns (name or name/type).
 /*	If no filters are specified, pcf_show_master_entries()
 /*	outputs all master.cf entries in the specified order.
 /* .IP field
 /*	Index into parsed master.cf entry.
 /* .IP new_value
 /*	Replacement value for the specified field. It is split in
 /*	whitespace in case of a multi-field attribute.
 /* DIAGNOSTICS
 /*	Problems are reported to the standard error stream.
 /* LICENSE
 /* .ad
 /* .fi
 /*	The Secure Mailer license must be distributed with this software.
 /* AUTHOR(S)
 /*	Wietse Venema
 /*	IBM T.J. Watson Research
 /*	P.O. Box 704
 /*	Yorktown Heights, NY 10598, USA
 /*--*/
 /* System library. */
 #include <sys_defs.h>
 #include <string.h>
 #include <stdlib.h>
 #include <stdarg.h>
 /* Utility library. */
 #include <msg.h>
 #include <mymalloc.h>
 #include <vstring.h>
 #include <argv.h>
 #include <vstream.h>
 #include <readlline.h>
 #include <stringops.h>
 #include <split_at.h>
 /* Global library. */
 #include <mail_params.h>
 /* Master library. */
 #include <master_proto.h>
 /* Application-specific. */
 #include <postconf.h>
 const char pcf_daemon_options_expecting_value[] = "o";
  /*
   * Data structure to capture a command-line service field filter.
   */
 typedef struct {
     int     match_count;		/* hit count */
     const char *raw_text;		/* full pattern text */
     ARGV   *service_pattern;		/* parsed service name, type, ... */
     int     field_pattern;		/* parsed field pattern */
     const char *param_pattern;		/* parameter pattern */
 } PCF_MASTER_FLD_REQ;
  /*
   * Valid inputs.
   */
 static const char *pcf_valid_master_types[] = {
     MASTER_XPORT_NAME_UNIX,
     MASTER_XPORT_NAME_FIFO,
     MASTER_XPORT_NAME_INET,
     MASTER_XPORT_NAME_PASS,
 ,
 };
 static const char pcf_valid_bool_types[] = "yn-";
 #define STR(x) vstring_str(x)
 /* pcf_normalize_options - bring options into canonical form */
 static void pcf_normalize_options(ARGV *argv)
+{
     int     field;
     char   *arg;
     char   *cp;
     char   *junk;
     /*
      * Normalize options to simplify later processing.
      */
     for (field = PCF_MASTER_MIN_FIELDS; argv->argv[field] != 0; field++) {
 	arg = argv->argv[field];
 	if (arg[0] != '-' || strcmp(arg, "--") == 0)
 	    break;
 	for (cp = arg + 1; *cp; cp++) {
 	    if (strchr(pcf_daemon_options_expecting_value, *cp) != 0
 		&& cp > arg + 1) {
 		/* Split "-stuffozz" into "-stuff" and "-ozz". */
 		junk = concatenate("-", cp, (char *) 0);
 		argv_insert_one(argv, field + 1, junk);
 		myfree(junk);
 		*cp = 0;			/* XXX argv_replace_one() */
 		break;
+	    }
+	}
 	if (strchr(pcf_daemon_options_expecting_value, arg[1]) == 0)
 	    /* Option requires no value. */
 	    continue;
 	if (arg[2] != 0) {
 	    /* Split "-oname=value" into "-o" "name=value". */
 	    argv_insert_one(argv, field + 1, arg + 2);
 	    arg[2] = 0;				/* XXX argv_replace_one() */
 	    field += 1;
 	} else if (argv->argv[field + 1] != 0) {
 	    /* Already in "-o" "name=value" form. */
 	    field += 1;
+	}
+    }
+}
 /* pcf_fix_fatal - fix multiline text before release */
 static NORETURN PRINTFLIKE(1, 2) pcf_fix_fatal(const char *fmt,...)
+{
     VSTRING *buf = vstring_alloc(100);
     va_list ap;
     /*
      * Replace newline with whitespace.
      */
     va_start(ap, fmt);
     vstring_vsprintf(buf, fmt, ap);
     va_end(ap);
     translit(STR(buf), "\n", " ");
     msg_fatal("%s", STR(buf));
     /* NOTREACHED */
+}
 /* pcf_check_master_entry - sanity check master.cf entry */
 static void pcf_check_master_entry(ARGV *argv, const char *raw_text)
+{
     const char **cpp;
     char   *cp;
     int     len;
     int     field;
     cp = argv->argv[PCF_MASTER_FLD_TYPE];
     for (cpp = pcf_valid_master_types; /* see below */ ; cpp++) {
 	if (*cpp == 0)
 	    pcf_fix_fatal("invalid " PCF_MASTER_NAME_TYPE " field \"%s\" in \"%s\"",
 			  cp, raw_text);
 	if (strcmp(*cpp, cp) == 0)
 	    break;
+    }
     for (field = PCF_MASTER_FLD_PRIVATE; field <= PCF_MASTER_FLD_CHROOT; field++) {
 	cp = argv->argv[field];
 	if (cp[1] != 0 || strchr(pcf_valid_bool_types, *cp) == 0)
-	    pcf_fix_fatal("invalid %s field \%s\" in \"%s\"",
+	    pcf_fix_fatal("invalid %s field \"%s\" in \"%s\"",
 			  pcf_str_field_pattern(field), cp, raw_text);
+    }
     cp = argv->argv[PCF_MASTER_FLD_WAKEUP];
     len = strlen(cp);
     if (len > 0 && cp[len - 1] == '?')
 	len--;
     if (!(cp[0] == '-' && len == 1) && strspn(cp, "0123456789") != len)
-	pcf_fix_fatal("invalid " PCF_MASTER_NAME_WAKEUP " field \%s\" in \"%s\"",
+	pcf_fix_fatal("invalid " PCF_MASTER_NAME_WAKEUP " field \"%s\" in \"%s\"",
 		      cp, raw_text);
     cp = argv->argv[PCF_MASTER_FLD_MAXPROC];
     if (strcmp("-", cp) != 0 && cp[strspn(cp, "0123456789")] != 0)
-	pcf_fix_fatal("invalid " PCF_MASTER_NAME_MAXPROC " field \%s\" in \"%s\"",
+	pcf_fix_fatal("invalid " PCF_MASTER_NAME_MAXPROC " field \"%s\" in \"%s\"",
 		      cp, raw_text);
+}
 /* pcf_free_master_entry - destroy parsed entry */
 void    pcf_free_master_entry(PCF_MASTER_ENT *masterp)
+{
     /* XX Fixme: allocation/deallocation asymmetry. */
     myfree(masterp->name_space);
     argv_free(masterp->argv);
     if (masterp->valid_names)
 	htable_free(masterp->valid_names, myfree);
     if (masterp->all_params)
 	dict_free(masterp->all_params);
     myfree((char *) masterp);
+}
 /* pcf_parse_master_entry - parse one master line */
 const char *pcf_parse_master_entry(PCF_MASTER_ENT *masterp, const char *buf)
+{
     ARGV   *argv;
     /*
      * We can't use the master daemon's master_ent routines in their current
      * form. They convert everything to internal form, and they skip disabled
      * services.
+     *
      * The postconf command needs to show default fields as "-", and needs to
      * know about all service names so that it can generate service-dependent
      * parameter names (transport-dependent etc.).
+     *
      * XXX Do per-field sanity checks.
      */
     argv = argv_split(buf, PCF_MASTER_BLANKS);
     if (argv->argc < PCF_MASTER_MIN_FIELDS) {
 	argv_free(argv);			/* Coverity 201311 */
 	return ("bad field count");
+    }
     pcf_check_master_entry(argv, buf);
     pcf_normalize_options(argv);
     masterp->name_space =
 	concatenate(argv->argv[0], PCF_NAMESP_SEP_STR, argv->argv[1], (char *) 0);
     masterp->argv = argv;
     masterp->valid_names = 0;
     masterp->all_params = 0;
     return (0);
+}
 /* pcf_read_master - read and digest the master.cf file */
 void    pcf_read_master(int fail_on_open_error)
+{
     const char *myname = "pcf_read_master";
     char   *path;
     VSTRING *buf;
     VSTREAM *fp;
     const char *err;
     int     entry_count = 0;
     int     line_count = 0;
     /*
      * Sanity check.
      */
     if (pcf_master_table != 0)
 	msg_panic("%s: master table is already initialized", myname);
     /*
      * Get the location of master.cf.
      */
     if (var_config_dir == 0)
 	pcf_set_config_dir();
     path = concatenate(var_config_dir, "/", MASTER_CONF_FILE, (char *) 0);
     /*
      * Initialize the in-memory master table.
      */
     pcf_master_table = (PCF_MASTER_ENT *) mymalloc(sizeof(*pcf_master_table));
     /*
      * Skip blank lines and comment lines. Degrade gracefully if master.cf is
      * not available, and master.cf is not the primary target.
      */
     if ((fp = vstream_fopen(path, O_RDONLY, 0)) == 0) {
 	if (fail_on_open_error)
 	    msg_fatal("open %s: %m", path);
 	msg_warn("open %s: %m", path);
     } else {
 	buf = vstring_alloc(100);
 	while (readlline(buf, fp, &line_count) != 0) {
 	    pcf_master_table = (PCF_MASTER_ENT *) myrealloc((char *) pcf_master_table,
 			     (entry_count + 2) * sizeof(*pcf_master_table));
 	    if ((err = pcf_parse_master_entry(pcf_master_table + entry_count,
 					      STR(buf))) != 0)
 		msg_fatal("file %s: line %d: %s", path, line_count, err);
 	    entry_count += 1;
+	}
 	vstream_fclose(fp);
 	vstring_free(buf);
+    }
     /*
      * Null-terminate the master table and clean up.
      */
     pcf_master_table[entry_count].argv = 0;
     myfree(path);
+}
 /* pcf_print_master_entry - print one master line */
 void    pcf_print_master_entry(VSTREAM *fp, int mode, PCF_MASTER_ENT *masterp)
+{
     char  **argv = masterp->argv->argv;
     const char *arg;
     const char *aval;
     int     arg_len;
     int     line_len;
     int     field;
     int     in_daemon_options;
     static int column_goal[] = {
 ,				/* service */
 ,				/* type */
 ,				/* private */
 ,				/* unpriv */
 ,				/* chroot */
 ,				/* wakeup */
 ,				/* maxproc */
 ,				/* command */
     };
 #define ADD_TEXT(text, len) do { \
         vstream_fputs(text, fp); line_len += len; } \
     while (0)
 #define ADD_SPACE ADD_TEXT(" ", 1)
     /*
      * Show the standard fields at their preferred column position. Use at
      * least one-space column separation.
      */
     for (line_len = 0, field = 0; field < PCF_MASTER_MIN_FIELDS; field++) {
 	arg = argv[field];
 	if (line_len > 0) {
 	    do {
 		ADD_SPACE;
 	    } while (line_len < column_goal[field]);
+	}
 	ADD_TEXT(arg, strlen(arg));
+    }
     /*
      * Format the daemon command-line options and non-option arguments. Here,
      * we have no data-dependent preference for column positions, but we do
      * have argument grouping preferences.
      */
     in_daemon_options = 1;
     for ( /* void */ ; (arg = argv[field]) != 0; field++) {
 	arg_len = strlen(arg);
 	aval = 0;
 	if (in_daemon_options) {
 	    /*
 	     * Try to show the generic options (-v -D) on the first line, and
 	     * non-options on a later line.
 	     */
 	    if (arg[0] != '-' || strcmp(arg, "--") == 0) {
 		in_daemon_options = 0;
 #if 0
 		if (mode & PCF_FOLD_LINE)
 		    /* Force line wrap. */
 		    line_len = PCF_LINE_LIMIT;
 #endif
+	    }
 	    /*
 	     * Special processing for options that require a value.
 	     */
 	    else if (strchr(pcf_daemon_options_expecting_value, arg[1]) != 0
 		     && (aval = argv[field + 1]) != 0) {
 		/* Force line wrap before option with value. */
 		line_len = PCF_LINE_LIMIT;
 		/*
 		 * Optionally, expand $name in parameter value.
 		 */
 		if (strcmp(arg, "-o") == 0
 		    && (mode & PCF_SHOW_EVAL) != 0)
 		    aval = pcf_expand_parameter_value((VSTRING *) 0, mode,
 						      aval, masterp);
 		/*
 		 * Keep option and value on the same line.
 		 */
 		arg_len += strlen(aval) + 1;
+	    }
+	}
 	/*
 	 * Insert a line break when the next item won't fit.
 	 */
 	if (line_len > PCF_INDENT_LEN) {
 	    if ((mode & PCF_FOLD_LINE) == 0
 		|| line_len + 1 + arg_len < PCF_LINE_LIMIT) {
 		ADD_SPACE;
 	    } else {
 		vstream_fputs("\n" PCF_INDENT_TEXT, fp);
 		line_len = PCF_INDENT_LEN;
+	    }
+	}
 	ADD_TEXT(arg, strlen(arg));
 	if (aval) {
 	    ADD_SPACE;
 	    ADD_TEXT(aval, strlen(aval));
 	    field += 1;
 	    /* Force line wrap after option with value. */
 	    line_len = PCF_LINE_LIMIT;
+	}
+    }
     vstream_fputs("\n", fp);
     if (msg_verbose)
 	vstream_fflush(fp);
+}
 /* pcf_show_master_entries - show master.cf entries */
 void    pcf_show_master_entries(VSTREAM *fp, int mode, int argc, char **argv)
+{
     PCF_MASTER_ENT *masterp;
     PCF_MASTER_FLD_REQ *field_reqs;
     PCF_MASTER_FLD_REQ *req;
     /*
      * Parse the filter expressions.
      */
     if (argc > 0) {
 	field_reqs = (PCF_MASTER_FLD_REQ *)
 	    mymalloc(sizeof(*field_reqs) * argc);
 	for (req = field_reqs; req < field_reqs + argc; req++) {
 	    req->match_count = 0;
 	    req->raw_text = *argv++;
 	    req->service_pattern =
 		pcf_parse_service_pattern(req->raw_text, 1, 2);
 	    if (req->service_pattern == 0)
 		msg_fatal("-M option requires service_name[/type]");
+	}
+    }
     /*
      * Iterate over the master table.
      */
     for (masterp = pcf_master_table; masterp->argv != 0; masterp++) {
 	if (argc > 0) {
 	    for (req = field_reqs; req < field_reqs + argc; req++) {
 		if (PCF_MATCH_SERVICE_PATTERN(req->service_pattern,
 					      masterp->argv->argv[0],
 					      masterp->argv->argv[1])) {
 		    req->match_count++;
 		    pcf_print_master_entry(fp, mode, masterp);
+		}
+	    }
 	} else {
 	    pcf_print_master_entry(fp, mode, masterp);
+	}
+    }
     /*
      * Cleanup.
      */
     if (argc > 0) {
 	for (req = field_reqs; req < field_reqs + argc; req++) {
 	    if (req->match_count == 0)
 		msg_warn("unmatched request: \"%s\"", req->raw_text);
 	    argv_free(req->service_pattern);
+	}
 	myfree((char *) field_reqs);
+    }
+}
 /* pcf_print_master_field - scaffolding */
 static void pcf_print_master_field(VSTREAM *fp, int mode,
 				           PCF_MASTER_ENT *masterp,
 				           int field)
+{
     char  **argv = masterp->argv->argv;
     const char *arg;
     const char *aval;
     int     arg_len;
     int     line_len;
     int     in_daemon_options;
     /*
      * Show the field value, or the first value in the case of a multi-column
      * field.
      */
 #define ADD_CHAR(ch) ADD_TEXT((ch), 1)
     line_len = 0;
     if ((mode & PCF_HIDE_NAME) == 0) {
 	ADD_TEXT(argv[0], strlen(argv[0]));
 	ADD_CHAR(PCF_NAMESP_SEP_STR);
 	ADD_TEXT(argv[1], strlen(argv[1]));
 	ADD_CHAR(PCF_NAMESP_SEP_STR);
 	ADD_TEXT(pcf_str_field_pattern(field), strlen(pcf_str_field_pattern(field)));
 	ADD_TEXT(" = ", 3);
 	if (line_len + strlen(argv[field]) > PCF_LINE_LIMIT) {
 	    vstream_fputs("\n" PCF_INDENT_TEXT, fp);
 	    line_len = PCF_INDENT_LEN;
+	}
+    }
     ADD_TEXT(argv[field], strlen(argv[field]));
     /*
      * Format the daemon command-line options and non-option arguments. Here,
      * we have no data-dependent preference for column positions, but we do
      * have argument grouping preferences.
      */
     if (field == PCF_MASTER_FLD_CMD) {
 	in_daemon_options = 1;
 	for (field += 1; (arg = argv[field]) != 0; field++) {
 	    arg_len = strlen(arg);
 	    aval = 0;
 	    if (in_daemon_options) {
 		/*
 		 * We make no special case for generic options (-v -D)
 		 * options.
 		 */
 		if (arg[0] != '-' || strcmp(arg, "--") == 0) {
 		    in_daemon_options = 0;
 		} else if (strchr(pcf_daemon_options_expecting_value, arg[1]) != 0
 			   && (aval = argv[field + 1]) != 0) {
 		    /* Force line break before option with value. */
 		    line_len = PCF_LINE_LIMIT;
 		    /*
 		     * Optionally, expand $name in parameter value.
 		     */
 		    if (strcmp(arg, "-o") == 0
 			&& (mode & PCF_SHOW_EVAL) != 0)
 			aval = pcf_expand_parameter_value((VSTRING *) 0, mode,
 							  aval, masterp);
 		    /*
 		     * Keep option and value on the same line.
 		     */
 		    arg_len += strlen(aval) + 1;
+		}
+	    }
 	    /*
 	     * Insert a line break when the next item won't fit.
 	     */
 	    if (line_len > PCF_INDENT_LEN) {
 		if ((mode & PCF_FOLD_LINE) == 0
 		    || line_len + 1 + arg_len < PCF_LINE_LIMIT) {
 		    ADD_SPACE;
 		} else {
 		    vstream_fputs("\n" PCF_INDENT_TEXT, fp);
 		    line_len = PCF_INDENT_LEN;
+		}
+	    }
 	    ADD_TEXT(arg, strlen(arg));
 	    if (aval) {
 		ADD_SPACE;
 		ADD_TEXT(aval, strlen(aval));
 		field += 1;
 		/* Force line break after option with value. */
 		line_len = PCF_LINE_LIMIT;
+	    }
+	}
+    }
     vstream_fputs("\n", fp);
     if (msg_verbose)
 	vstream_fflush(fp);
+}
 /* pcf_show_master_fields - show master.cf fields */
 void    pcf_show_master_fields(VSTREAM *fp, int mode, int argc, char **argv)
+{
     const char *myname = "pcf_show_master_fields";
     PCF_MASTER_ENT *masterp;
     PCF_MASTER_FLD_REQ *field_reqs;
     PCF_MASTER_FLD_REQ *req;
     int     field;
     /*
      * Parse the filter expressions.
      */
     if (argc > 0) {
 	field_reqs = (PCF_MASTER_FLD_REQ *)
 	    mymalloc(sizeof(*field_reqs) * argc);
 	for (req = field_reqs; req < field_reqs + argc; req++) {
 	    req->match_count = 0;
 	    req->raw_text = *argv++;
 	    req->service_pattern =
 		pcf_parse_service_pattern(req->raw_text, 1, 3);
 	    if (req->service_pattern == 0)
 		msg_fatal("-F option requires service_name[/type[/field]]");
 	    field = req->field_pattern =
 		pcf_parse_field_pattern(req->service_pattern->argv[2]);
 	    if (pcf_is_magic_field_pattern(field) == 0
 		&& (field < 0 || field > PCF_MASTER_FLD_CMD))
 		msg_panic("%s: bad attribute field index: %d",
 			  myname, field);
+	}
+    }
     /*
      * Iterate over the master table.
      */
     for (masterp = pcf_master_table; masterp->argv != 0; masterp++) {
 	if (argc > 0) {
 	    for (req = field_reqs; req < field_reqs + argc; req++) {
 		if (PCF_MATCH_SERVICE_PATTERN(req->service_pattern,
 					      masterp->argv->argv[0],
 					      masterp->argv->argv[1])) {
 		    req->match_count++;
 		    field = req->field_pattern;
 		    if (pcf_is_magic_field_pattern(field)) {
 			for (field = 0; field <= PCF_MASTER_FLD_CMD; field++)
 			    pcf_print_master_field(fp, mode, masterp, field);
 		    } else {
 			pcf_print_master_field(fp, mode, masterp, field);
+		    }
+		}
+	    }
 	} else {
 	    for (field = 0; field <= PCF_MASTER_FLD_CMD; field++)
 		pcf_print_master_field(fp, mode, masterp, field);
+	}
+    }
     /*
      * Cleanup.
      */
     if (argc > 0) {
 	for (req = field_reqs; req < field_reqs + argc; req++) {
 	    if (req->match_count == 0)
 		msg_warn("unmatched request: \"%s\"", req->raw_text);
 	    argv_free(req->service_pattern);
+	}
 	myfree((char *) field_reqs);
+    }
+}
 /* pcf_edit_master_field - replace master.cf field value. */
 void    pcf_edit_master_field(PCF_MASTER_ENT *masterp, int field,
 			              const char *new_value)
+{
     /*
      * Replace multi-column attribute.
      */
     if (field == PCF_MASTER_FLD_CMD) {
 	argv_truncate(masterp->argv, PCF_MASTER_FLD_CMD);
 	argv_split_append(masterp->argv, new_value, PCF_MASTER_BLANKS);
+    }
     /*
      * Replace single-column attribute.
      */
     else {
 	argv_replace_one(masterp->argv, field, new_value);
+    }
     /*
      * Do per-field sanity checks.
      */
     pcf_check_master_entry(masterp->argv, new_value);
+}
 /* pcf_print_master_param - scaffolding */
 static void pcf_print_master_param(VSTREAM *fp, int mode,
 				           PCF_MASTER_ENT *masterp,
 				           const char *param_name,
 				           const char *param_value)
+{
     if ((mode & PCF_SHOW_EVAL) != 0)
 	param_value = pcf_expand_parameter_value((VSTRING *) 0, mode,
 						 param_value, masterp);
     if ((mode & PCF_HIDE_NAME) == 0) {
 	pcf_print_line(fp, mode, "%s%c%s = %s\n",
 		       masterp->name_space, PCF_NAMESP_SEP_CH,
 		       param_name, param_value);
     } else {
 	pcf_print_line(fp, mode, "%s\n", param_value);
+    }
     if (msg_verbose)
 	vstream_fflush(fp);
+}
 /* pcf_sort_argv_cb - sort argv call-back */
 static int pcf_sort_argv_cb(const void *a, const void *b)
+{
     return (strcmp(*(char **) a, *(char **) b));
+}
 /* pcf_show_master_any_param - show any parameter in master.cf service entry */
 static void pcf_show_master_any_param(VSTREAM *fp, int mode,
 				              PCF_MASTER_ENT *masterp)
+{
     const char *myname = "pcf_show_master_any_param";
     ARGV   *argv = argv_alloc(10);
     DICT   *dict = masterp->all_params;
     const char *param_name;
     const char *param_value;
     int     param_count = 0;
     int     how;
     char  **cpp;
     /*
      * Print parameters in sorted order. The number of parameters per
      * master.cf entry is small, so we optmiize for code simplicity and don't
      * worry about the cost of double lookup.
      */
     /* Look up the parameter names and ignore the values. */
     for (how = DICT_SEQ_FUN_FIRST;
 	 dict->sequence(dict, how, &param_name, &param_value) == 0;
 	 how = DICT_SEQ_FUN_NEXT) {
 	argv_add(argv, param_name, ARGV_END);
 	param_count++;
+    }
     /* Print the parameters in sorted order. */
     qsort(argv->argv, param_count, sizeof(argv->argv[0]), pcf_sort_argv_cb);
     for (cpp = argv->argv; (param_name = *cpp) != 0; cpp++) {
 	if ((param_value = dict_get(dict, param_name)) == 0)
 	    msg_panic("%s: parameter name not found: %s", myname, param_name);
 	pcf_print_master_param(fp, mode, masterp, param_name, param_value);
+    }
     /*
      * Clean up.
      */
     argv_free(argv);
+}
 /* pcf_show_master_params - show master.cf params */
 void    pcf_show_master_params(VSTREAM *fp, int mode, int argc, char **argv)
+{
     PCF_MASTER_ENT *masterp;
     PCF_MASTER_FLD_REQ *field_reqs;
     PCF_MASTER_FLD_REQ *req;
     DICT   *dict;
     const char *param_value;
     /*
      * Parse the filter expressions.
      */
     if (argc > 0) {
 	field_reqs = (PCF_MASTER_FLD_REQ *)
 	    mymalloc(sizeof(*field_reqs) * argc);
 	for (req = field_reqs; req < field_reqs + argc; req++) {
 	    req->match_count = 0;
 	    req->raw_text = *argv++;
 	    req->service_pattern =
 		pcf_parse_service_pattern(req->raw_text, 1, 3);
 	    if (req->service_pattern == 0)
 		msg_fatal("-P option requires service_name[/type[/parameter]]");
 	    req->param_pattern = req->service_pattern->argv[2];
+	}
+    }
     /*
      * Iterate over the master table.
      */
     for (masterp = pcf_master_table; masterp->argv != 0; masterp++) {
 	if ((dict = masterp->all_params) != 0) {
 	    if (argc > 0) {
 		for (req = field_reqs; req < field_reqs + argc; req++) {
 		    if (PCF_MATCH_SERVICE_PATTERN(req->service_pattern,
 						  masterp->argv->argv[0],
 						  masterp->argv->argv[1])) {
 			if (PCF_IS_MAGIC_PARAM_PATTERN(req->param_pattern)) {
 			    pcf_show_master_any_param(fp, mode, masterp);
 			    req->match_count += 1;
 			} else if ((param_value = dict_get(dict,
 						req->param_pattern)) != 0) {
 			    pcf_print_master_param(fp, mode, masterp,
 						   req->param_pattern,
 						   param_value);
 			    req->match_count += 1;
+			}
+		    }
+		}
 	    } else {
 		pcf_show_master_any_param(fp, mode, masterp);
+	    }
+	}
+    }
     /*
      * Cleanup.
      */
     if (argc > 0) {
 	for (req = field_reqs; req < field_reqs + argc; req++) {
 	    if (req->match_count == 0)
 		msg_warn("unmatched request: \"%s\"", req->raw_text);
 	    argv_free(req->service_pattern);
+	}
 	myfree((char *) field_reqs);
+    }
+}
 /* pcf_edit_master_param - update, add or remove -o parameter=value */
 void    pcf_edit_master_param(PCF_MASTER_ENT *masterp, int mode,
 			              const char *param_name,
 			              const char *param_value)
+{
     const char *myname = "pcf_edit_master_param";
     ARGV   *argv = masterp->argv;
     const char *arg;
     const char *aval;
     int     param_match = 0;
     int     name_len = strlen(param_name);
     int     field;
     for (field = PCF_MASTER_MIN_FIELDS; argv->argv[field] != 0; field++) {
 	arg = argv->argv[field];
 	/*
 	 * Stop at the first non-option argument or end-of-list.
 	 */
 	if (arg[0] != '-' || strcmp(arg, "--") == 0) {
 	    break;
+	}
 	/*
 	 * Zoom in on command-line options with a value.
 	 */
 	else if (strchr(pcf_daemon_options_expecting_value, arg[1]) != 0
 		 && (aval = argv->argv[field + 1]) != 0) {
 	    /*
 	     * Zoom in on "-o parameter=value".
 	     */
 	    if (strcmp(arg, "-o") == 0) {
 		if (strncmp(aval, param_name, name_len) == 0
 		    && aval[name_len] == '=') {
 		    param_match = 1;
 		    switch (mode & (PCF_EDIT_CONF | PCF_EDIT_EXCL)) {
 			/*
 			 * Update parameter=value.
 			 */
 		    case PCF_EDIT_CONF:
 			aval = concatenate(param_name, "=",
 					   param_value, (char *) 0);
 			argv_replace_one(argv, field + 1, aval);
 			myfree((char *) aval);
 			if (masterp->all_params)
 			    dict_put(masterp->all_params, param_name, param_value);
 			/* XXX Update parameter "used/defined" status. */
 			break;
 			/*
 			 * Delete parameter=value.
 			 */
 		    case PCF_EDIT_EXCL:
 			argv_delete(argv, field, 2);
 			if (masterp->all_params)
 			    dict_del(masterp->all_params, param_name);
 			/* XXX Update parameter "used/defined" status. */
 			field -= 2;
 			break;
 		    default:
 			msg_panic("%s: unexpected mode: %d", myname, mode);
+		    }
+		}
+	    }
 	    /*
 	     * Skip over the command-line option value.
 	     */
 	    field += 1;
+	}
+    }
     /*
      * Add unmatched parameter.
      */
     if ((mode & PCF_EDIT_CONF) && param_match == 0) {
 	/* XXX Generalize: argv_insert(argv, where, list...) */
 	argv_insert_one(argv, field, "-o");
 	aval = concatenate(param_name, "=",
 			   param_value, (char *) 0);
 	argv_insert_one(argv, field + 1, aval);
 	if (masterp->all_params)
 	    dict_put(masterp->all_params, param_name, param_value);
 	/* XXX May affect parameter "used/defined" status. */
 	myfree((char *) aval);
 	param_match = 1;
+    }
+}

 @@ -1,847 +1,849 @@
-/*	$NetBSD: smtp_tls_policy.c,v 1.1.1.1 2014/07/06 19:27:56 tron Exp $	*/
+/*	$NetBSD: smtp_tls_policy.c,v 1.1.1.1.4.1 2015/03/03 07:11:08 snj Exp $	*/
 /*++
 /* NAME
 /*	smtp_tls_policy 3
 /* SUMMARY
 /*	SMTP_TLS_POLICY structure management
 /* SYNOPSIS
 /*	#include "smtp.h"
 /*
 /*	void    smtp_tls_list_init()
 /*
 /*	int	smtp_tls_policy_cache_query(why, tls, iter)
 /*	DSN_BUF	*why;
 /*	SMTP_TLS_POLICY *tls;
 /*	SMTP_ITERATOR *iter;
 /*
 /*	void	smtp_tls_policy_dummy(tls)
 /*	SMTP_TLS_POLICY *tls;
 /*
 /*	void	smtp_tls_policy_cache_flush()
 /* DESCRIPTION
 /*	smtp_tls_list_init() initializes lookup tables used by the TLS
 /*	policy engine.
 /*
 /*	smtp_tls_policy_cache_query() returns a shallow copy of the
 /*	cached SMTP_TLS_POLICY structure for the iterator's
 /*	destination, host, port and DNSSEC validation status.
 /*	This copy is guaranteed to be valid until the next
 /*	smtp_tls_policy_cache_query() or smtp_tls_policy_cache_flush()
 /*	call.  The caller can override the TLS security level without
 /*	corrupting the policy cache.
 /*	When any required table or DNS lookups fail, the TLS level
 /*	is set to TLS_LEV_INVALID, the "why" argument is updated
 /*	with the error reason and the result value is zero (false).
 /*
 /*	smtp_tls_policy_dummy() initializes a trivial, non-cached,
 /*	policy with TLS disabled.
 /*
 /*	smtp_tls_policy_cache_flush() destroys the TLS policy cache
 /*	and contents.
 /*
 /*	Arguments:
 /* .IP why
 /*	A pointer to a DSN_BUF which holds error status information when
 /*	the TLS policy lookup fails.
 /* .IP tls
 /*	Pointer to TLS policy storage.
 /* .IP iter
 /*	The literal next-hop or fall-back destination including
 /*	the optional [] and including the :port or :service;
 /*	the name of the remote host after MX and CNAME expansions
 /*	(see smtp_cname_overrides_servername for the handling
 /*	of hostnames that resolve to a CNAME record);
 /*	the printable address of the remote host;
 /*	the remote port in network byte order;
 /*	the DNSSEC validation status of the host name lookup after
 /*	MX and CNAME expansions.
 /* LICENSE
 /* .ad
 /* .fi
 /*	This software is free. You can do with it whatever you want.
 /*	The original author kindly requests that you acknowledge
 /*	the use of his software.
 /* AUTHOR(S)
 /*	TLS support originally by:
 /*	Lutz Jaenicke
 /*	BTU Cottbus
 /*	Allgemeine Elektrotechnik
 /*	Universitaetsplatz 3-4
 /*	D-03044 Cottbus, Germany
 /*
 /*	Updated by:
 /*	Wietse Venema
 /*	IBM T.J. Watson Research
 /*	P.O. Box 704
 /*	Yorktown Heights, NY 10598, USA
 /*
 /*	Viktor Dukhovni
 /*--*/
 /* System library. */
 #include <sys_defs.h>
 #ifdef USE_TLS
 #include <netinet/in.h>			/* ntohs() for Solaris or BSD */
 #include <arpa/inet.h>			/* ntohs() for Linux or BSD */
 #include <stdlib.h>
 #include <string.h>
 #ifdef STRCASECMP_IN_STRINGS_H
 #include <strings.h>
 #endif
 /* Utility library. */
 #include <msg.h>
 #include <mymalloc.h>
 #include <vstring.h>
 #include <stringops.h>
 #include <valid_hostname.h>
 #include <ctable.h>
 /* Global library. */
 #include <mail_params.h>
 #include <maps.h>
 #include <dsn_buf.h>
 /* DNS library. */
 #include <dns.h>
 /* Application-specific. */
 #include "smtp.h"
 /* XXX Cache size should scale with [sl]mtp_mx_address_limit. */
 #define CACHE_SIZE 20
 static CTABLE *policy_cache;
 static int global_tls_level(void);
 static void dane_init(SMTP_TLS_POLICY *, SMTP_ITERATOR *);
 static MAPS *tls_policy;		/* lookup table(s) */
 static MAPS *tls_per_site;		/* lookup table(s) */
 /* smtp_tls_list_init - initialize per-site policy lists */
 void    smtp_tls_list_init(void)
+{
     if (*var_smtp_tls_policy) {
 	tls_policy = maps_create(SMTP_X(TLS_POLICY), var_smtp_tls_policy,
 				 DICT_FLAG_LOCK | DICT_FLAG_FOLD_FIX);
 	if (*var_smtp_tls_per_site)
 	    msg_warn("%s ignored when %s is not empty.",
 		     SMTP_X(TLS_PER_SITE), SMTP_X(TLS_POLICY));
 	return;
+    }
     if (*var_smtp_tls_per_site) {
 	tls_per_site = maps_create(SMTP_X(TLS_PER_SITE), var_smtp_tls_per_site,
 				   DICT_FLAG_LOCK | DICT_FLAG_FOLD_FIX);
+    }
+}
 /* policy_name - printable tls policy level */
 static const char *policy_name(int tls_level)
+{
     const char *name = str_tls_level(tls_level);
     if (name == 0)
 	name = "unknown";
     return name;
+}
 #define MARK_INVALID(why, levelp) do { \
 	    dsb_simple((why), "4.7.5", "client TLS configuration problem"); \
 	    *(levelp) = TLS_LEV_INVALID; } while (0)
 /* tls_site_lookup - look up per-site TLS security level */
 static void tls_site_lookup(SMTP_TLS_POLICY *tls, int *site_level,
 		              const char *site_name, const char *site_class)
+{
     const char *lookup;
     /*
      * Look up a non-default policy. In case of multiple lookup results, the
      * precedence order is a permutation of the TLS enforcement level order:
      * VERIFY, ENCRYPT, NONE, MAY, NOTFOUND. I.e. we override MAY with a more
      * specific policy including NONE, otherwise we choose the stronger
      * enforcement level.
      */
     if ((lookup = maps_find(tls_per_site, site_name, 0)) != 0) {
 	if (!strcasecmp(lookup, "NONE")) {
 	    /* NONE overrides MAY or NOTFOUND. */
 	    if (*site_level <= TLS_LEV_MAY)
 		*site_level = TLS_LEV_NONE;
 	} else if (!strcasecmp(lookup, "MAY")) {
 	    /* MAY overrides NOTFOUND but not NONE. */
 	    if (*site_level < TLS_LEV_NONE)
 		*site_level = TLS_LEV_MAY;
 	} else if (!strcasecmp(lookup, "MUST_NOPEERMATCH")) {
 	    if (*site_level < TLS_LEV_ENCRYPT)
 		*site_level = TLS_LEV_ENCRYPT;
 	} else if (!strcasecmp(lookup, "MUST")) {
 	    if (*site_level < TLS_LEV_VERIFY)
 		*site_level = TLS_LEV_VERIFY;
 	} else {
 	    msg_warn("%s: unknown TLS policy '%s' for %s %s",
 		     tls_per_site->title, lookup, site_class, site_name);
 	    MARK_INVALID(tls->why, site_level);
 	    return;
+	}
     } else if (tls_per_site->error) {
 	msg_warn("%s: %s \"%s\": per-site table lookup error",
 		 tls_per_site->title, site_class, site_name);
 	dsb_simple(tls->why, "4.3.0", "Temporary lookup error");
 	*site_level = TLS_LEV_INVALID;
 	return;
+    }
     return;
+}
 /* tls_policy_lookup_one - look up destination TLS policy */
 static void tls_policy_lookup_one(SMTP_TLS_POLICY *tls, int *site_level,
 				          const char *site_name,
 				          const char *site_class)
+{
     const char *lookup;
     char   *policy;
     char   *saved_policy;
     char   *tok;
     const char *err;
     char   *name;
     char   *val;
     static VSTRING *cbuf;
 #undef FREE_RETURN
 #define FREE_RETURN do { myfree(saved_policy); return; } while (0)
 #define INVALID_RETURN(why, levelp) do { \
 	    MARK_INVALID((why), (levelp)); FREE_RETURN; } while (0)
 #define WHERE \
     STR(vstring_sprintf(cbuf, "%s, %s \"%s\"", \
 		tls_policy->title, site_class, site_name))
     if (cbuf == 0)
 	cbuf = vstring_alloc(10);
     if ((lookup = maps_find(tls_policy, site_name, 0)) == 0) {
 	if (tls_policy->error) {
 	    msg_warn("%s: policy table lookup error", WHERE);
 	    MARK_INVALID(tls->why, site_level);
+	}
 	return;
+    }
     saved_policy = policy = mystrdup(lookup);
     if ((tok = mystrtok(&policy, "\t\n\r ,")) == 0) {
 	msg_warn("%s: invalid empty policy", WHERE);
 	INVALID_RETURN(tls->why, site_level);
+    }
     *site_level = tls_level_lookup(tok);
     if (*site_level == TLS_LEV_INVALID) {
 	/* tls_level_lookup() logs no warning. */
 	msg_warn("%s: invalid security level \"%s\"", WHERE, tok);
 	INVALID_RETURN(tls->why, site_level);
+    }
     /*
      * Warn about ignored attributes when TLS is disabled.
      */
     if (*site_level < TLS_LEV_MAY) {
 	while ((tok = mystrtok(&policy, "\t\n\r ,")) != 0)
 	    msg_warn("%s: ignoring attribute \"%s\" with TLS disabled",
 		     WHERE, tok);
 	FREE_RETURN;
+    }
     /*
      * Errors in attributes may have security consequences, don't ignore
      * errors that can degrade security.
      */
     while ((tok = mystrtok(&policy, "\t\n\r ,")) != 0) {
 	if ((err = split_nameval(tok, &name, &val)) != 0) {
 	    msg_warn("%s: malformed attribute/value pair \"%s\": %s",
 		     WHERE, tok, err);
 	    INVALID_RETURN(tls->why, site_level);
+	}
 	/* Only one instance per policy. */
 	if (!strcasecmp(name, "ciphers")) {
 	    if (*val == 0) {
 		msg_warn("%s: attribute \"%s\" has empty value", WHERE, name);
 		INVALID_RETURN(tls->why, site_level);
+	    }
 	    if (tls->grade) {
 		msg_warn("%s: attribute \"%s\" is specified multiple times",
 			 WHERE, name);
 		INVALID_RETURN(tls->why, site_level);
+	    }
 	    tls->grade = mystrdup(val);
 	    continue;
+	}
 	/* Only one instance per policy. */
 	if (!strcasecmp(name, "protocols")) {
 	    if (tls->protocols) {
 		msg_warn("%s: attribute \"%s\" is specified multiple times",
 			 WHERE, name);
 		INVALID_RETURN(tls->why, site_level);
+	    }
 	    tls->protocols = mystrdup(val);
 	    continue;
+	}
 	/* Multiple instances per policy. */
 	if (!strcasecmp(name, "match")) {
 	    if (*val == 0) {
 		msg_warn("%s: attribute \"%s\" has empty value", WHERE, name);
 		INVALID_RETURN(tls->why, site_level);
+	    }
 	    switch (*site_level) {
 	    default:
 		msg_warn("%s: attribute \"%s\" invalid at security level "
 			 "\"%s\"", WHERE, name, policy_name(*site_level));
 		INVALID_RETURN(tls->why, site_level);
 		break;
 	    case TLS_LEV_FPRINT:
 		if (!tls->dane)
 		    tls->dane = tls_dane_alloc();
 		tls_dane_add_ee_digests(tls->dane,
 					var_smtp_tls_fpt_dgst, val, "|");
 		break;
 	    case TLS_LEV_VERIFY:
 	    case TLS_LEV_SECURE:
 		if (tls->matchargv == 0)
 		    tls->matchargv = argv_split(val, ":");
 		else
 		    argv_split_append(tls->matchargv, val, ":");
 		break;
+	    }
 	    continue;
+	}
 	/* Only one instance per policy. */
 	if (!strcasecmp(name, "exclude")) {
 	    if (tls->exclusions) {
 		msg_warn("%s: attribute \"%s\" is specified multiple times",
 			 WHERE, name);
 		INVALID_RETURN(tls->why, site_level);
+	    }
 	    tls->exclusions = vstring_strcpy(vstring_alloc(10), val);
 	    continue;
+	}
 	/* Multiple instances per policy. */
 	if (!strcasecmp(name, "tafile")) {
 	    /* Only makes sense if we're using CA-based trust */
 	    if (!TLS_MUST_PKIX(*site_level)) {
 		msg_warn("%s: attribute \"%s\" invalid at security level"
 			 " \"%s\"", WHERE, name, policy_name(*site_level));
 		INVALID_RETURN(tls->why, site_level);
+	    }
 	    if (*val == 0) {
 		msg_warn("%s: attribute \"%s\" has empty value", WHERE, name);
 		INVALID_RETURN(tls->why, site_level);
+	    }
 	    if (!tls->dane)
 		tls->dane = tls_dane_alloc();
 	    if (!tls_dane_load_trustfile(tls->dane, val)) {
 		INVALID_RETURN(tls->why, site_level);
+	    }
 	    continue;
+	}
 	msg_warn("%s: invalid attribute name: \"%s\"", WHERE, name);
 	INVALID_RETURN(tls->why, site_level);
+    }
     FREE_RETURN;
+}
 /* tls_policy_lookup - look up destination TLS policy */
 static void tls_policy_lookup(SMTP_TLS_POLICY *tls, int *site_level,
 			              const char *site_name,
 			              const char *site_class)
+{
     /*
      * Only one lookup with [nexthop]:port, [nexthop] or nexthop:port These
      * are never the domain part of localpart@domain, rather they are
      * explicit nexthops from transport:nexthop, and match only the
      * corresponding policy. Parent domain matching (below) applies only to
      * sub-domains of the recipient domain.
+     *
      * XXX UNIX-domain connections query with the pathname as destination.
      */
     if (!valid_hostname(site_name, DONT_GRIPE)) {
 	tls_policy_lookup_one(tls, site_level, site_name, site_class);
 	return;
+    }
     do {
 	tls_policy_lookup_one(tls, site_level, site_name, site_class);
     } while (*site_level == TLS_LEV_NOTFOUND
 	     && (site_name = strchr(site_name + 1, '.')) != 0);
+}
 /* load_tas - load one or more ta files */
 static int load_tas(TLS_DANE *dane, const char *files)
+{
     int     ret = 0;
     char   *save = mystrdup(files);
     char   *buf = save;
     char   *file;
     do {
 	if ((file = mystrtok(&buf, "\t\n\r ,")) != 0)
 	    ret = tls_dane_load_trustfile(dane, file);
     } while (file && ret);
     myfree(save);
     return (ret);
+}
 /* set_cipher_grade - Set cipher grade and exclusions */
 static void set_cipher_grade(SMTP_TLS_POLICY *tls)
+{
     const char *mand_exclude = "";
     const char *also_exclude = "";
     /*
      * Use main.cf cipher level if no per-destination value specified. With
      * mandatory encryption at least encrypt, and with mandatory verification
      * at least authenticate!
      */
     switch (tls->level) {
     case TLS_LEV_INVALID:
     case TLS_LEV_NONE:
 	return;
     case TLS_LEV_MAY:
 	if (tls->grade == 0)
 	    tls->grade = mystrdup(var_smtp_tls_ciph);
 	break;
     case TLS_LEV_ENCRYPT:
 	if (tls->grade == 0)
 	    tls->grade = mystrdup(var_smtp_tls_mand_ciph);
 	mand_exclude = var_smtp_tls_mand_excl;
 	also_exclude = "eNULL";
 	break;
     case TLS_LEV_DANE:
     case TLS_LEV_FPRINT:
     case TLS_LEV_VERIFY:
     case TLS_LEV_SECURE:
 	if (tls->grade == 0)
 	    tls->grade = mystrdup(var_smtp_tls_mand_ciph);
 	mand_exclude = var_smtp_tls_mand_excl;
 	also_exclude = "aNULL";
 	break;
+    }
 #define ADD_EXCLUDE(vstr, str) \
     do { \
 	if (*(str)) \
 	    vstring_sprintf_append((vstr), "%s%s", \
 				   VSTRING_LEN(vstr) ? " " : "", (str)); \
     } while (0)
     /*
      * The "exclude" policy table attribute overrides main.cf exclusion
      * lists.
      */
     if (tls->exclusions == 0) {
 	tls->exclusions = vstring_alloc(10);
 	ADD_EXCLUDE(tls->exclusions, var_smtp_tls_excl_ciph);
 	ADD_EXCLUDE(tls->exclusions, mand_exclude);
+    }
     ADD_EXCLUDE(tls->exclusions, also_exclude);
+}
 /* policy_create - create SMTP TLS policy cache object (ctable call-back) */
 static void *policy_create(const char *unused_key, void *context)
+{
     SMTP_ITERATOR *iter = (SMTP_ITERATOR *) context;
     int     site_level;
     const char *dest = STR(iter->dest);
     const char *host = STR(iter->host);
     /*
      * Prepare a pristine policy object.
      */
     SMTP_TLS_POLICY *tls = (SMTP_TLS_POLICY *) mymalloc(sizeof(*tls));
     smtp_tls_policy_init(tls, dsb_create());
     /*
      * Compute the per-site TLS enforcement level. For compatibility with the
      * original TLS patch, this algorithm is gives equal precedence to host
      * and next-hop policies.
      */
     tls->level = global_tls_level();
     site_level = TLS_LEV_NOTFOUND;
     if (tls_policy) {
 	tls_policy_lookup(tls, &site_level, dest, "next-hop destination");
     } else if (tls_per_site) {
 	tls_site_lookup(tls, &site_level, dest, "next-hop destination");
 	if (site_level != TLS_LEV_INVALID
 	    && strcasecmp(dest, host) != 0)
 	    tls_site_lookup(tls, &site_level, host, "server hostname");
 	/*
 	 * Override a wild-card per-site policy with a more specific global
 	 * policy.
+	 *
 	 * With the original TLS patch, 1) a per-site ENCRYPT could not override
 	 * a global VERIFY, and 2) a combined per-site (NONE+MAY) policy
 	 * produced inconsistent results: it changed a global VERIFY into
 	 * NONE, while producing MAY with all weaker global policy settings.
+	 *
 	 * With the current implementation, a combined per-site (NONE+MAY)
 	 * consistently overrides global policy with NONE, and global policy
 	 * can override only a per-site MAY wildcard. That is, specific
 	 * policies consistently override wildcard policies, and
 	 * (non-wildcard) per-site policies consistently override global
 	 * policies.
 	 */
 	if (site_level == TLS_LEV_MAY && tls->level > TLS_LEV_MAY)
 	    site_level = tls->level;
+    }
     switch (site_level) {
     default:
 	tls->level = site_level;
 	/* FALLTHROUGH */
     case TLS_LEV_NOTFOUND:
 	break;
     case TLS_LEV_INVALID:
 	tls->level = site_level;
 	return ((void *) tls);
+    }
     /*
      * DANE initialization may change the security level to something else,
      * so do this early, so that we use the right level below.  Note that
      * "dane-only" changes to "dane" once we obtain the requisite TLSA
      * records.
      */
     if (tls->level == TLS_LEV_DANE || tls->level == TLS_LEV_DANE_ONLY)
 	dane_init(tls, iter);
     if (tls->level == TLS_LEV_INVALID)
 	return ((void *) tls);
     /*
      * Use main.cf protocols setting if not set in per-destination table.
      */
     if (tls->level > TLS_LEV_NONE && tls->protocols == 0)
 	tls->protocols =
 	    mystrdup((tls->level == TLS_LEV_MAY) ?
 		     var_smtp_tls_proto : var_smtp_tls_mand_proto);
     /*
      * Compute cipher grade (if set in per-destination table, else
      * set_cipher() uses main.cf settings) and security level dependent
      * cipher exclusion list.
      */
     set_cipher_grade(tls);
     /*
      * Use main.cf cert_match setting if not set in per-destination table.
      */
     switch (tls->level) {
     case TLS_LEV_INVALID:
     case TLS_LEV_NONE:
     case TLS_LEV_MAY:
     case TLS_LEV_ENCRYPT:
     case TLS_LEV_DANE:
 	break;
     case TLS_LEV_FPRINT:
 	if (tls->dane == 0)
 	    tls->dane = tls_dane_alloc();
 	if (!TLS_DANE_HASEE(tls->dane)) {
 	    tls_dane_add_ee_digests(tls->dane, var_smtp_tls_fpt_dgst,
 				    var_smtp_tls_fpt_cmatch, "\t\n\r, ");
 	    if (!TLS_DANE_HASEE(tls->dane)) {
 		msg_warn("nexthop domain %s: configured at fingerprint "
 		       "security level, but with no fingerprints to match.",
 			 dest);
 		MARK_INVALID(tls->why, &tls->level);
 		return ((void *) tls);
+	    }
+	}
 	break;
     case TLS_LEV_VERIFY:
     case TLS_LEV_SECURE:
 	if (tls->matchargv == 0)
 	    tls->matchargv =
 		argv_split(tls->level == TLS_LEV_VERIFY ?
 			   var_smtp_tls_vfy_cmatch : var_smtp_tls_sec_cmatch,
 			   "\t\n\r, :");
 	if (*var_smtp_tls_tafile) {
 	    if (tls->dane == 0)
 		tls->dane = tls_dane_alloc();
 	    if (!TLS_DANE_HASTA(tls->dane)
 		&& !load_tas(tls->dane, var_smtp_tls_tafile)) {
 		MARK_INVALID(tls->why, &tls->level);
 		return ((void *) tls);
+	    }
+	}
 	break;
     default:
 	msg_panic("unexpected TLS security level: %d", tls->level);
+    }
     if (msg_verbose && tls->level != global_tls_level())
 	msg_info("%s TLS level: %s", "effective", policy_name(tls->level));
     return ((void *) tls);
+}
 /* policy_delete - free no longer cached policy (ctable call-back) */
 static void policy_delete(void *item, void *unused_context)
+{
     SMTP_TLS_POLICY *tls = (SMTP_TLS_POLICY *) item;
     if (tls->protocols)
 	myfree(tls->protocols);
     if (tls->grade)
 	myfree(tls->grade);
     if (tls->exclusions)
 	vstring_free(tls->exclusions);
     if (tls->matchargv)
 	argv_free(tls->matchargv);
     if (tls->dane)
 	tls_dane_free(tls->dane);
     dsb_free(tls->why);
     myfree((char *) tls);
+}
 /* smtp_tls_policy_cache_query - cached lookup of TLS policy */
 int     smtp_tls_policy_cache_query(DSN_BUF *why, SMTP_TLS_POLICY *tls,
 				            SMTP_ITERATOR *iter)
+{
     VSTRING *key;
     /*
      * Create an empty TLS Policy cache on the fly.
      */
     if (policy_cache == 0)
 	policy_cache =
 	    ctable_create(CACHE_SIZE, policy_create, policy_delete, (void *) 0);
     /*
      * Query the TLS Policy cache, with a search key that reflects our shared
      * values that also appear in other cache and table search keys.
      */
     key = vstring_alloc(100);
     smtp_key_prefix(key, ":", iter, SMTP_KEY_FLAG_NEXTHOP
 		    | SMTP_KEY_FLAG_HOSTNAME
 		    | SMTP_KEY_FLAG_PORT);
     ctable_newcontext(policy_cache, (void *) iter);
     *tls = *(SMTP_TLS_POLICY *) ctable_locate(policy_cache, STR(key));
     vstring_free(key);
     /*
      * Report errors. Both error and non-error results are cached. We must
      * therefore copy the cached DSN buffer content to the caller's buffer.
      */
     if (tls->level == TLS_LEV_INVALID) {
 	/* XXX Simplify this by implementing a "copy" primitive. */
 	dsb_update(why,
 		   STR(tls->why->status), STR(tls->why->action),
 		   STR(tls->why->mtype), STR(tls->why->mname),
 		   STR(tls->why->dtype), STR(tls->why->dtext),
 		   "%s", STR(tls->why->reason));
 	return (0);
     } else {
 	return (1);
+    }
+}
 /* smtp_tls_policy_cache_flush - flush TLS policy cache */
 void    smtp_tls_policy_cache_flush(void)
+{
     if (policy_cache != 0) {
 	ctable_free(policy_cache);
 	policy_cache = 0;
+    }
+}
 /* global_tls_level - parse and cache var_smtp_tls_level */
 static int global_tls_level(void)
+{
     static int l = TLS_LEV_NOTFOUND;
     if (l != TLS_LEV_NOTFOUND)
 	return l;
     /*
      * Compute the global TLS policy. This is the default policy level when
      * no per-site policy exists. It also is used to override a wild-card
      * per-site policy.
+     *
      * We require that the global level is valid on startup.
      */
     if (*var_smtp_tls_level) {
 	if ((l = tls_level_lookup(var_smtp_tls_level)) == TLS_LEV_INVALID)
 	    msg_fatal("invalid tls security level: \"%s\"", var_smtp_tls_level);
     } else if (var_smtp_enforce_tls)
 	l = var_smtp_tls_enforce_peername ? TLS_LEV_VERIFY : TLS_LEV_ENCRYPT;
     else
 	l = var_smtp_use_tls ? TLS_LEV_MAY : TLS_LEV_NONE;
     if (msg_verbose)
 	msg_info("%s TLS level: %s", "global", policy_name(l));
     return l;
+}
 #define NONDANE_CONFIG	0		/* Administrator's fault */
 #define NONDANE_DEST	1		/* Remote server's fault */
 #define DANE_UNUSABLE	2		/* Remote server's fault */
 static void PRINTFLIKE(4, 5) dane_incompat(SMTP_TLS_POLICY *tls,
 					           SMTP_ITERATOR *iter,
 					           int errtype,
 					           const char *fmt,...)
+{
     va_list ap;
     va_start(ap, fmt);
     if (tls->level == TLS_LEV_DANE) {
 	tls->level = (errtype == DANE_UNUSABLE) ? TLS_LEV_ENCRYPT : TLS_LEV_MAY;
 	if (errtype == NONDANE_CONFIG)
 	    vmsg_warn(fmt, ap);
 	else if (msg_verbose)
 	    vmsg_info(fmt, ap);
     } else {					/* dane-only */
 	if (errtype == NONDANE_CONFIG) {
 	    vmsg_warn(fmt, ap);
 	    MARK_INVALID(tls->why, &tls->level);
 	} else {
 	    tls->level = TLS_LEV_INVALID;
 	    vdsb_simple(tls->why, "4.7.5", fmt, ap);
+	}
+    }
     va_end(ap);
+}
 /* dane_init - special initialization for "dane" security level */
 static void dane_init(SMTP_TLS_POLICY *tls, SMTP_ITERATOR *iter)
+{
     TLS_DANE *dane;
     if (!iter->port) {
 	msg_warn("%s: the \"dane\" security level is invalid for delivery via"
 		 " unix-domain sockets", STR(iter->dest));
 	MARK_INVALID(tls->why, &tls->level);
 	return;
+    }
     if (!tls_dane_avail()) {
 	dane_incompat(tls, iter, NONDANE_CONFIG,
 		      "%s: %s configured, but no requisite library support",
 		      STR(iter->dest), policy_name(tls->level));
 	return;
+    }
     if (!(smtp_host_lookup_mask & SMTP_HOST_FLAG_DNS)
 	|| smtp_dns_support != SMTP_DNS_DNSSEC) {
 	dane_incompat(tls, iter, NONDANE_CONFIG,
 		      "%s: %s configured with dnssec lookups disabled",
 		      STR(iter->dest), policy_name(tls->level));
 	return;
+    }
     /*
      * If we ignore MX lookup errors, we also ignore DNSSEC security problems
      * and thus avoid any reasonable expectation that we get the right DANE
      * key material.
      */
     if (smtp_mode && var_ign_mx_lookup_err) {
 	dane_incompat(tls, iter, NONDANE_CONFIG,
 		      "%s: %s configured with MX lookup errors ignored",
 		      STR(iter->dest), policy_name(tls->level));
 	return;
+    }
     /*
      * This is not optional, code in tls_dane.c assumes that the nexthop
      * qname is already an fqdn.  If we're using these flags to go from qname
      * to rname, the assumption is invalid.  Likewise we cannot add the qname
      * to certificate name checks, ...
      */
     if (smtp_dns_res_opt & (RES_DEFNAMES | RES_DNSRCH)) {
 	dane_incompat(tls, iter, NONDANE_CONFIG,
 		      "%s: dns resolver options incompatible with %s TLS",
 		      STR(iter->dest), policy_name(tls->level));
 	return;
+    }
     /* When the MX name is present and insecure, DANE does not apply. */
     if (iter->mx && !iter->mx->dnssec_valid) {
 	dane_incompat(tls, iter, NONDANE_DEST, "non DNSSEC destination");
 	return;
+    }
     /* When TLSA lookups fail, we defer the message */
     if ((dane = tls_dane_resolve(iter->port, "tcp", iter->rr,
 				 var_smtp_tls_force_tlsa)) == 0) {
 	tls->level = TLS_LEV_INVALID;
 	dsb_simple(tls->why, "4.7.5", "TLSA lookup error for %s:%u",
 		   STR(iter->host), ntohs(iter->port));
 	return;
+    }
     if (tls_dane_notfound(dane)) {
 	dane_incompat(tls, iter, NONDANE_DEST, "no TLSA records found");
 	tls_dane_free(dane);
 	return;
+    }
     /*
      * Some TLSA records found, but none usable, per
+     *
      * https://tools.ietf.org/html/draft-ietf-dane-srv-02#section-4
+     *
      * we MUST use TLS, and SHALL use full PKIX certificate checks.  The latter
      * would be unwise for SMTP: no human present to "click ok" and risk of
      * non-delivery in most cases exceeds risk of interception.
+     *
      * We also have a form of Goedel's incompleteness theorem in play: any list
      * of public root CA certs is either incomplete or inconsistent (for any
      * given verifier some of the CAs are surely not trustworthy).
      */
     if (tls_dane_unusable(dane)) {
 	dane_incompat(tls, iter, DANE_UNUSABLE, "TLSA records unusable");
 	tls_dane_free(dane);
 	return;
+    }
     /*
      * With DANE trust anchors, peername matching is not configurable.
      */
     if (TLS_DANE_HASTA(dane)) {
 	tls->matchargv = argv_alloc(2);
 	argv_add(tls->matchargv, dane->base_domain, ARGV_END);
 	if (iter->mx) {
 	    if (strcmp(iter->mx->qname, iter->mx->rname) == 0)
 		argv_add(tls->matchargv, iter->mx->qname, ARGV_END);
 	    else
 		argv_add(tls->matchargv, iter->mx->rname,
 			 iter->mx->qname, ARGV_END);
+	}
     } else if (!TLS_DANE_HASEE(dane))
 	msg_panic("empty DANE match list");
     tls->dane = dane;
     tls->level = TLS_LEV_DANE;
     return;
+}
 #endif

 @@ -1,174 +1,183 @@
-/*	$NetBSD: cleanup_map1n.c,v 1.1.1.4 2014/07/06 19:27:49 tron Exp $	*/
+/*	$NetBSD: cleanup_map1n.c,v 1.1.1.4.2.1 2015/03/03 07:11:08 snj Exp $	*/
 /*++
 /* NAME
 /*	cleanup_map1n 3
 /* SUMMARY
 /*	one-to-many address mapping
 /* SYNOPSIS
 /*	#include <cleanup.h>
 /*
 /*	ARGV	*cleanup_map1n_internal(state, addr, maps, propagate)
 /*	CLEANUP_STATE *state;
 /*	const char *addr;
 /*	MAPS	*maps;
 /*	int	propagate;
 /* DESCRIPTION
 /*	This module implements one-to-many table mapping via table lookup.
 /*	Table lookups are done with quoted (externalized) address forms.
 /*	The process is recursive. The recursion terminates when the
 /*	left-hand side appears in its own expansion.
 /*
 /*	cleanup_map1n_internal() is the interface for addresses in
 /*	internal (unquoted) form.
 /* DIAGNOSTICS
 /*	When the maximal expansion or recursion limit is reached,
 /*	the alias is not expanded and the CLEANUP_STAT_DEFER error
 /*	is raised with reason "4.6.0 Alias expansion error".
 /*
 /*	When table lookup fails, the alias is not expanded and the
 /*	CLEANUP_STAT_WRITE error is raised with reason "4.6.0 Alias
 /*	expansion error".
 /* SEE ALSO
 /*	mail_addr_map(3) address mappings
 /*	mail_addr_find(3) address lookups
 /* LICENSE
 /* .ad
 /* .fi
 /*	The Secure Mailer license must be distributed with this software.
 /* AUTHOR(S)
 /*	Wietse Venema
 /*	IBM T.J. Watson Research
 /*	P.O. Box 704
 /*	Yorktown Heights, NY 10598, USA
 /*--*/
 /* System library. */
 #include <sys_defs.h>
 #include <string.h>
 #ifdef STRCASECMP_IN_STRINGS_H
 #include <strings.h>
 #endif
 /* Utility library. */
 #include <mymalloc.h>
 #include <msg.h>
 #include <argv.h>
 #include <vstring.h>
 #include <dict.h>
 /* Global library. */
 #include <mail_params.h>
 #include <mail_addr_map.h>
 #include <cleanup_user.h>
 #include <quote_822_local.h>
 #include <been_here.h>
 /* Application-specific. */
 #include "cleanup.h"
 /* cleanup_map1n_internal - one-to-many table lookups */
 ARGV   *cleanup_map1n_internal(CLEANUP_STATE *state, const char *addr,
 			               MAPS *maps, int propagate)
+{
     ARGV   *argv;
     ARGV   *lookup;
     int     count;
     int     i;
     int     arg;
     BH_TABLE *been_here;
     char   *saved_lhs;
     /*
      * Initialize.
      */
     argv = argv_alloc(1);
     argv_add(argv, addr, ARGV_END);
     argv_terminate(argv);
     been_here = been_here_init(0, BH_FLAG_FOLD);
     /*
      * Rewrite the address vector in place. With each map lookup result,
      * split it into separate addresses, then rewrite and flatten each
      * address, and repeat the process. Beware: argv is being changed, so we
      * must index the array explicitly, instead of running along it with a
      * pointer.
      */
 #define UPDATE(ptr,new)	do { \
 	if (ptr) myfree(ptr); ptr = mystrdup(new); \
     } while (0)
 #define STR	vstring_str
 #define RETURN(x) do { \
 	been_here_free(been_here); return (x); \
     } while (0)
 #define UNEXPAND(argv, addr) do { \
 	argv_truncate((argv), 0); argv_add((argv), (addr), (char *) 0); \
     } while (0)
     for (arg = 0; arg < argv->argc; arg++) {
 	if (argv->argc > var_virt_expan_limit) {
 	    msg_warn("%s: unreasonable %s map expansion size for %s -- "
 		     "message not accepted, try again later",
 		     state->queue_id, maps->title, addr);
 	    state->errs |= CLEANUP_STAT_DEFER;
 	    UPDATE(state->reason, "4.6.0 Alias expansion error");
 	    UNEXPAND(argv, addr);
 	    RETURN(argv);
+	}
 	for (count = 0; /* void */ ; count++) {
 	    /*
 	     * Don't expand an address that already expanded into itself.
 	     */
 	    if (been_here_check_fixed(been_here, argv->argv[arg]) != 0)
 		break;
 	    if (count >= var_virt_recur_limit) {
 		msg_warn("%s: unreasonable %s map nesting for %s -- "
 			 "message not accepted, try again later",
 			 state->queue_id, maps->title, addr);
 		state->errs |= CLEANUP_STAT_DEFER;
 		UPDATE(state->reason, "4.6.0 Alias expansion error");
 		UNEXPAND(argv, addr);
 		RETURN(argv);
+	    }
 	    quote_822_local(state->temp1, argv->argv[arg]);
 	    if ((lookup = mail_addr_map(maps, STR(state->temp1), propagate)) != 0) {
 		saved_lhs = mystrdup(argv->argv[arg]);
 		for (i = 0; i < lookup->argc; i++) {
 		    if (strlen(lookup->argv[i]) > var_line_limit) {
 			msg_warn("%s: unreasonable %s result %.300s... -- "
 				 "message not accepted, try again later",
 			     state->queue_id, maps->title, lookup->argv[i]);
 			state->errs |= CLEANUP_STAT_DEFER;
 			UPDATE(state->reason, "4.6.0 Alias expansion error");
 			UNEXPAND(argv, addr);
 			RETURN(argv);
+		    }
 		    unquote_822_local(state->temp1, lookup->argv[i]);
 		    if (i == 0) {
 			UPDATE(argv->argv[arg], STR(state->temp1));
 		    } else {
 			argv_add(argv, STR(state->temp1), ARGV_END);
 			argv_terminate(argv);
+		    }
 		    /*
 		     * Allow an address to expand into itself once.
 		     */
 		    if (strcasecmp(saved_lhs, STR(state->temp1)) == 0)
 			been_here_fixed(been_here, saved_lhs);
+		}
 		myfree(saved_lhs);
 		argv_free(lookup);
 	    } else if (maps->error != 0) {
 		msg_warn("%s: %s map lookup problem for %s -- "
 			 "message not accepted, try again later",
 			 state->queue_id, maps->title, addr);
 		state->errs |= CLEANUP_STAT_WRITE;
 		UPDATE(state->reason, "4.6.0 Alias expansion error");
 		UNEXPAND(argv, addr);
 		RETURN(argv);
 	    } else {
 		break;
+	    }
+	}
+    }
     RETURN(argv);
+}

 @@ -1,106 +1,106 @@
-/*	$NetBSD: mail_version.h,v 1.1.1.21.2.1 2015/01/27 08:14:03 martin Exp $	*/
+/*	$NetBSD: mail_version.h,v 1.1.1.21.2.2 2015/03/03 07:11:08 snj Exp $	*/
 #ifndef _MAIL_VERSION_H_INCLUDED_
 #define _MAIL_VERSION_H_INCLUDED_
 /*++
 /* NAME
 /*	mail_version 3h
 /* SUMMARY
 /*	globally configurable parameters
 /* SYNOPSIS
 /*	#include <mail_version.h>
 /* DESCRIPTION
 /* .nf
  /*
   * Version of this program. Official versions are called a.b.c, and
   * snapshots are called a.b-yyyymmdd, where a=major release number, b=minor
   * release number, c=patchlevel, and yyyymmdd is the release date:
   * yyyy=year, mm=month, dd=day.
+  *
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20141019"
+#define MAIL_RELEASE_DATE	"20150208"
-#define MAIL_VERSION_NUMBER	"2.11.3"
+#define MAIL_VERSION_NUMBER	"2.11.4"
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
 #else
 #define MAIL_VERSION_DATE	""
 #endif
 #ifdef NONPROD
 #define MAIL_VERSION_PROD	"-nonprod"
 #else
 #define MAIL_VERSION_PROD	""
 #endif
 #define VAR_MAIL_VERSION	"mail_version"
 #define DEF_MAIL_VERSION	MAIL_VERSION_NUMBER MAIL_VERSION_DATE MAIL_VERSION_PROD
 extern char *var_mail_version;
  /*
   * Release date.
   */
 #define VAR_MAIL_RELEASE	"mail_release_date"
 #define DEF_MAIL_RELEASE	MAIL_RELEASE_DATE
 extern char *var_mail_release;
  /*
   * The following macros stamp executable files as well as core dumps. This
   * information helps to answer the following questions:
+  *
   * - What Postfix versions(s) are installed on this machine?
+  *
   * - Is this installation mixing multiple Postfix versions?
+  *
   * - What Postfix version generated this core dump?
+  *
   * To find out: strings -f file... | grep mail_version=
   */
 #include <string.h>
 #define MAIL_VERSION_STAMP_DECLARE \
     char *mail_version_stamp
 #define MAIL_VERSION_STAMP_ALLOCATE \
     mail_version_stamp = strdup(VAR_MAIL_VERSION "=" DEF_MAIL_VERSION)
  /*
   * Mail version string parser, plus support to compare the compile-time
   * version string of a Postfix program with the run-time version string of a
   * Postfix shared library. When programs are not updated, they may fail in
   * erratic ways when linked against a newer run-time library. Of course the
   * right solution is so-number versioning of the Postfix run-time library.
   */
 typedef struct {
     char   *program;			/* postfix */
     int     major;			/* 2 */
     int     minor;			/* 9 */
     int     patch;			/* null */
     char   *snapshot;			/* 20111209-nonprod */
 } MAIL_VERSION;
 extern MAIL_VERSION *mail_version_parse(const char *, const char **);
 extern void mail_version_free(MAIL_VERSION *);
 extern const char *get_mail_version(void);
 extern void check_mail_version(const char *);
 #define MAIL_VERSION_CHECK \
     check_mail_version(DEF_MAIL_VERSION)
 /* LICENSE
 /* .ad
 /* .fi
 /*	The Secure Mailer license must be distributed with this software.
 /* AUTHOR(S)
 /*	Wietse Venema
 /*	IBM T.J. Watson Research
 /*	P.O. Box 704
 /*	Yorktown Heights, NY 10598, USA
 /*--*/
 #endif

 @@ -1,309 +1,310 @@
-/*	$NetBSD: tok822_tree.c,v 1.1.1.1 2009/06/23 10:08:48 tron Exp $	*/
+/*	$NetBSD: tok822_tree.c,v 1.1.1.1.28.1 2015/03/03 07:11:08 snj Exp $	*/
 /*++
 /* NAME
 /*	tok822_tree 3
 /* SUMMARY
 /*	assorted token tree operators
 /* SYNOPSIS
 /*	#include <tok822.h>
 /*
 /*	TOK822	*tok822_append(t1, t2)
 /*	TOK822	*t1;
 /*	TOK822	*t2;
 /*
 /*	TOK822	*tok822_prepend(t1, t2)
 /*	TOK822	*t1;
 /*	TOK822	*t2;
 /*
 /*	TOK822	*tok822_cut_before(tp)
 /*	TOK822	*tp;
 /*
 /*	TOK822	*tok822_cut_after(tp)
 /*	TOK822	*tp;
 /*
 /*	TOK822	*tok822_unlink(tp)
 /*	TOK822	*tp;
 /*
 /*	TOK822	*tok822_sub_append(t1, t2)
 /*	TOK822	*t1;
 /*
 /*	TOK822	*tok822_sub_prepend(t1, t2)
 /*	TOK822	*t1;
 /*	TOK822	*t2;
 /*
 /*	TOK822	*tok822_sub_keep_before(t1, t2)
 /*	TOK822	*tp;
 /*
 /*	TOK822	*tok822_sub_keep_after(t1, t2)
 /*	TOK822	*tp;
 /*
 /*	int	tok822_apply(list, type, action)
 /*	TOK822	*list;
 /*	int	type;
 /*	int	(*action)(TOK822 *token);
 /*
 /*	int	tok822_grep(list, type)
 /*	TOK822	*list;
 /*	int	type;
 /*
 /*	TOK822	*tok822_free_tree(tp)
 /*	TOK822	*tp;
 /* DESCRIPTION
 /*	This module manipulates trees of token structures. Trees grow
 /*	to the right or downwards. Operators are provided to cut and
 /*	combine trees in various manners.
 /*
 /*	tok822_append() appends the token list \fIt2\fR to the right
 /*	of token list \fIt1\fR. The result is the last token in \fIt2\fR.
 /*	The appended list inherits the \fIowner\fR attribute from \fIt1\fR.
 /*	The parent node, if any, is not updated.
 /*
 /*	tok822_prepend() inserts the token list \fIt2\fR to the left
 /*	of token \fIt1\fR. The result is the last token in \fIt2\fR.
 /*	The appended list inherits the \fIowner\fR attribute from \fIt1\fR.
 /*	The parent node, if any, is not updated.
 /*
 /*	tok822_cut_before() breaks a token list on the left side of \fItp\fR
 /*	and returns the left neighbor of \tItp\fR.
 /*
 /*	tok822_cut_after() breaks a token list on the right side of \fItp\fR
 /*	and returns the right neighbor of \tItp\fR.
 /*
 /*	tok822_unlink() disconnects a token from its left and right neighbors
 /*	and returns the left neighbor of \tItp\fR.
 /*
 /*	tok822_sub_append() appends the token list \fIt2\fR to the right
 /*	of the token list below \fIt1\fR. The result is the last token
 /*	in \fIt2\fR.
 /*
 /*	tok822_sub_prepend() prepends the token list \fIt2\fR to the left
 /*	of the token list below \fIt1\fR. The result is the last token
 /*	in \fIt2\fR.
 /*
 /*	tok822_sub_keep_before() keeps the token list below \fIt1\fR on the
 /*	left side of \fIt2\fR and returns the tail of the disconnected list.
 /*
 /*	tok822_sub_keep_after() keeps the token list below \fIt1\fR on the
 /*	right side of \fIt2\fR and returns the head of the disconnected list.
 /*
 /*	tok822_apply() applies the specified action routine to all tokens
 /*	matching the given type (to all tokens when a null type is given).
 /*	Processing terminates when the action routine returns a non-zero
 /*	value. The result is the last result returned by the action routine.
 /*	tok822_apply() does not traverse vertical links.
 /*
 /*	tok822_grep() returns a null-terminated array of pointers to tokens
 /*	matching the specified type (all tokens when a null type is given).
 /*	tok822_grep() does not traverse vertical links. The result must be
 /*	given to myfree().
 /*
 /*	tok822_free_tree() destroys a tree of token structures and
 /*	conveniently returns a null pointer.
 /* LICENSE
 /* .ad
 /* .fi
 /*	The Secure Mailer license must be distributed with this software.
 /* AUTHOR(S)
 /*	Wietse Venema
 /*	IBM T.J. Watson Research
 /*	P.O. Box 704
 /*	Yorktown Heights, NY 10598, USA
 /*--*/
 /* System library. */
 #include <sys_defs.h>
 /* Utility library. */
 #include <mymalloc.h>
 #include <vstring.h>
 /* Global library. */
 #include "tok822.h"
 /* tok822_append - insert token list, return end of inserted list */
 TOK822 *tok822_append(TOK822 *t1, TOK822 *t2)
+{
     TOK822 *next = t1->next;
     t1->next = t2;
     t2->prev = t1;
     t2->owner = t1->owner;
     while (t2->next)
 	(t2 = t2->next)->owner = t1->owner;
     t2->next = next;
     if (next)
 	next->prev = t2;
     return (t2);
+}
 /* tok822_prepend - insert token list, return end of inserted list */
 TOK822 *tok822_prepend(TOK822 *t1, TOK822 *t2)
+{
     TOK822 *prev = t1->prev;
     if (prev)
 	prev->next = t2;
     t2->prev = prev;
     t2->owner = t1->owner;
     while (t2->next)
 	(t2 = t2->next)->owner = t1->owner;
     t2->next = t1;
     t1->prev = t2;
     return (t2);
+}
 /* tok822_cut_before - split list before token, return predecessor token */
 TOK822 *tok822_cut_before(TOK822 *tp)
+{
     TOK822 *prev = tp->prev;
     if (prev) {
 	prev->next = 0;
 	tp->prev = 0;
+    }
     return (prev);
+}
 /* tok822_cut_after - split list after token, return successor token */
 TOK822 *tok822_cut_after(TOK822 *tp)
+{
     TOK822 *next = tp->next;
     if (next) {
 	next->prev = 0;
 	tp->next = 0;
+    }
     return (next);
+}
 /* tok822_unlink - take token away from list, return predecessor token */
 TOK822 *tok822_unlink(TOK822 *tp)
+{
     TOK822 *prev = tp->prev;
     TOK822 *next = tp->next;
     if (prev)
 	prev->next = next;
     if (next)
 	next->prev = prev;
     tp->prev = tp->next = 0;
     return (prev);
+}
 /* tok822_sub_append - append sublist, return end of appended list */
 TOK822 *tok822_sub_append(TOK822 *t1, TOK822 *t2)
+{
     if (t1->head) {
 	return (t1->tail = tok822_append(t1->tail, t2));
     } else {
 	t1->head = t2;
 	while (t2->next)
 	    (t2 = t2->next)->owner = t1;
 	return (t1->tail = t2);
+    }
+}
 /* tok822_sub_prepend - prepend sublist, return end of prepended list */
 TOK822 *tok822_sub_prepend(TOK822 *t1, TOK822 *t2)
+{
     TOK822 *tp;
     if (t1->head) {
 	tp = tok822_prepend(t1->head, t2);
 	t1->head = t2;
 	return (tp);
     } else {
 	t1->head = t2;
 	while (t2->next)
 	    (t2 = t2->next)->owner = t1;
 	return (t1->tail = t2);
+    }
+}
 /* tok822_sub_keep_before - cut sublist, return tail of disconnected list */
 TOK822 *tok822_sub_keep_before(TOK822 *t1, TOK822 *t2)
+{
     TOK822 *tail = t1->tail;
     if ((t1->tail = tok822_cut_before(t2)) == 0)
 	t1->head = 0;
     return (tail);
+}
 /* tok822_sub_keep_after - cut sublist, return head of disconnected list */
 TOK822 *tok822_sub_keep_after(TOK822 *t1, TOK822 *t2)
+{
     TOK822 *head = t1->head;
     if ((t1->head = tok822_cut_after(t2)) == 0)
 	t1->tail = 0;
     return (head);
+}
 /* tok822_free_tree - destroy token tree */
 TOK822 *tok822_free_tree(TOK822 *tp)
+{
-    if (tp) {
+    TOK822 *next;
 	if (tp->next)
-	    tok822_free_tree(tp->next);
+    for (/* void */; tp != 0; tp = next) {
 	if (tp->head)
 	    tok822_free_tree(tp->head);
 	next = tp->next;
 	tok822_free(tp);
+    }
     return (0);
+}
 /* tok822_apply - apply action to specified tokens */
 int     tok822_apply(TOK822 *tree, int type, TOK822_ACTION action)
+{
     TOK822 *tp;
     int     result = 0;
     for (tp = tree; tp; tp = tp->next) {
 	if (type == 0 || tp->type == type)
 	    if ((result = action(tp)) != 0)
 		break;
+    }
     return (result);
+}
 /* tok822_grep - list matching tokens */
 TOK822 **tok822_grep(TOK822 *tree, int type)
+{
     TOK822 **list;
     TOK822 *tp;
     int     count;
     for (count = 0, tp = tree; tp; tp = tp->next)
 	if (type == 0 || tp->type == type)
 	    count++;
     list = (TOK822 **) mymalloc(sizeof(*list) * (count + 1));
     for (count = 0, tp = tree; tp; tp = tp->next)
 	if (type == 0 || tp->type == type)
 	    list[count++] = tp;
     list[count] = 0;
     return (list);
+}