# changelog

author: Paul Oehler <poehler@interworx.com>
changelog:
  - Added patch to support openssl 1.1.1
  - updated sources/qmail-gentestcrt.sh.bz2 to make work on almalinux


author: jpurkis <jpurkis@interworx.com>
changelog:
  - Update makecert.sh to use 2048 bit keys
  - Update makecert.sh to use SHA256
  - Regen certs on install


author: Joseph Purkis <jpurkis@interworx.com>
changelog:
  - Adding Almalinux and cleaning up old rhexs
  - Added interworx-prep-vpopmail for details look at interworx-prep-vpopmail notes.


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Wire IWORX_CONNECT_TIMEOUT into remote_smtp_default's connect_timeout so the
    stored outbound SMTP connect timeout control actually takes effect


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Add email group expansion router so mail to a group alias is delivered to
    every member; reference config macros bare, space multi-line SQL lookups,
    deliver via the stored maildir, and move queue lifetime into the retry rule


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Drop maildrop from the mail path (IWX-15060), keeping qmail behavior: scan in
    the DATA ACL only when the recipient domain has .spamon, under the recipient's
    own SA profile, skipping oversized messages; fold X-Spam-Flag mail to .Spam
    only when that folder already exists (spam_junk_router/transport), else tag to
    inbox; fix spam_drop_router (bare-number .dropscore, integer score compare);
    remove the maildrop transport_filter and the dead exim_user_filter.sh. No
    Requires: maildrop.


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Add per-user email alias router so mail to an alias is redirected to its
    stored destination before per-user mailbox routing


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Stop accepting mail for local parts that have no mailbox: gate per_user_router
    on +real_mailboxes and add unknown_user_router, which reproduces qmail's
    .bounceon / .catchall / delete precedence. Replaces catchall_router, which was
    unseen and looked .catchall up as a keyed file. Drop spam_bounce_router, which
    reused .bounceon for a behavior qmail never had


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Unescape user_forward_router's condition so the forward-file existence test
    is actually evaluated instead of always returning true


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Write the interworx-mail env flag without a trailing newline so consumers can
    compare it against "exim" directly


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Enforce the MTA-level recipient blacklist: refuse RCPT for any address in the
    IWORX_BADRCPTTO control, which the panel already wrote but no ACL ever read


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Enforce the MTA-level sender blacklist and the realtime DNS blacklists: refuse
    senders in IWORX_BADMAILFROM at MAIL, and sending hosts listed in any
    IWORX_DNSBLS zone at RCPT. Both controls were written by the panel but no ACL
    ever read them


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Comment out the two remaining live greylisting warns, which set a reason string
    that nothing reads: the exim-greylist package is not shipped and the .include
    that consumes it is commented out


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Point av_scanner at the TCP socket (127.0.0.1:3310) the interworx clamav
    package's clamd actually listens on, instead of a unix socket nothing
    configures, so the malware check below can reach the daemon
  - Add an active malware condition to the DATA ACL, gated on IWORX_VIRUS_SCAN_ENABLED,
    so NodeWorx's global virus-scanning on/off takes effect under Exim, matching qmail


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Gate the DATA ACL spam scan on the IWORX_SPAM_SCAN_ENABLED macro so NodeWorx's
    global spam-scanning on/off takes effect under Exim, matching qmail


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Define the address_directory transport that user_forward_router's
    directory_transport pointed at but that never existed, so a forward filter's
    directory save no longer fails with an unknown-transport error


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Sign outbound mail with DKIM: walk the sender's account's own domains for a
    key the same way qmail's wrapper walked parent domains, but scoped to the
    sender's own account so it can never sign with another account's key. Also
    let a local sender claim an envelope address in a domain it owns, so DKIM
    has a real domain to key off for locally-injected mail (e.g. PHP mail())


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Own /etc/domainkeys, matching how qmail.spec owns it when qmail is installed
    instead. Without this the directory never existed on an Exim-only box, so
    turning on DomainKeys for the first domain on the box silently failed


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Added Exim configuration files (exim.conf and conf.d/ structure)
  - Added mysql capabilities to exim auth


author: Nathan Roth <nroth@interworx.com>
changelog:
  - Stop shipping dovecot-sql.conf.ext; InterWorx writes iworx-exim-dovecot-sql.conf.ext at install time
  - Remove legacy /etc/dovecot/dovecot-sql.conf.ext on upgrade


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Add /etc/exim/vfilters directory for user filter scripts
  - Replace per-user filter_rules_router with domain_filter_router using native Exim allow_filter
  - Remove filtered_delivery_transport and user_filter.sh (replaced by /etc/exim/vfilters/<domain>)


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Move root_email, hostname, sender_ip out of conf.d to /etc/exim/ (IWX-14428)
  - Rename smtp_auth_mode.conf to smtp_auth_mode in conf.d to prevent conf.d glob pickup


author: Nathan Roth <nroth@interworx.com>
changelog:
  - Add Dovecot quota_status service configuration for SMTP-time quota checks (IWX-14359)
  - Enable quota-status service on localhost:12340 to support Exim pre-delivery quota validation


author: Nathan Roth <nroth@interworx.com>
changelog:
  - Add Exim RCPT ACL quota check that queries Dovecot quota-status service (IWX-14359)
  - Query localhost:12340 for over-quota recipients and reject before DATA phase


author: Nathan Roth <nroth@interworx.com>
changelog:
  - Fix double Maildir path in mail_location - remove /Maildir suffix since pw_dir already includes it


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Rename dovecot_95-iworx-quota.conf to dovecot_92-iworx-quota.conf so the global
    mail_plugins setting is parsed before the protocol imap filter in
    95-iworx-imap.conf, allowing imap_quota to find its required quota plugin and
    enabling quota plugin loading for lmtp delivery enforcement (IWX-14616)


author: Billy Piper <bpiper@liquidweb.com>
changelog:
  - Ship empty 21-iworx-submission-ports.conf so InterWorx can manage the
    alternate submission port with correct ownership from install


