Prereq: "2.6.16"
diff -cr --new-file /var/tmp/postfix-2.6.16/src/global/mail_version.h ./src/global/mail_version.h
*** /var/tmp/postfix-2.6.16/src/global/mail_version.h	Sun May 20 18:12:59 2012
--- ./src/global/mail_version.h	Wed Aug  1 17:42:20 2012
***************
*** 20,27 ****
    * Patches change both the patchlevel and the release date. Snapshots have no
    * patchlevel; they change the release date only.
    */
! #define MAIL_RELEASE_DATE	"20120520"
! #define MAIL_VERSION_NUMBER	"2.6.16"
  
  #ifdef SNAPSHOT
  # define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
--- 20,27 ----
    * Patches change both the patchlevel and the release date. Snapshots have no
    * patchlevel; they change the release date only.
    */
! #define MAIL_RELEASE_DATE	"20120801"
! #define MAIL_VERSION_NUMBER	"2.6.17"
  
  #ifdef SNAPSHOT
  # define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
diff -cr --new-file /var/tmp/postfix-2.6.16/HISTORY ./HISTORY
*** /var/tmp/postfix-2.6.16/HISTORY	Sun May 20 18:08:10 2012
--- ./HISTORY	Wed Aug  1 17:42:43 2012
***************
*** 15658,15660 ****
--- 15658,15671 ----
  	command must wait until its requests have reached the pickup
  	and qmgr servers before closing the UNIX-domain request
  	sockets.  Files: postqueue/postqueue.c, postqueue/Makefile.in.
+ 
+ 20120702
+ 
+ 	Bugfix (introduced: 19990127): the BIFF client leaked an
+ 	unprivileged UDP socket. Fix by Jaroslav Skarvada.  File:
+ 	local/biff_notify.c.
+ 
+ 20120730
+ 
+ 	Bugfix (introduced: 20000314): AUTH is not allowed after
+ 	MAIL. Timo Sirainen.  File: smtpd/smtpd_sasl_proto.c.
diff -cr --new-file /var/tmp/postfix-2.6.16/src/local/biff_notify.c ./src/local/biff_notify.c
*** /var/tmp/postfix-2.6.16/src/local/biff_notify.c	Wed Jul 13 16:46:18 2005
--- ./src/local/biff_notify.c	Thu Jul  5 12:56:30 2012
***************
*** 43,48 ****
--- 43,49 ----
  /* Utility library. */
  
  #include <msg.h>
+ #include <iostuff.h>
  
  /* Application-specific. */
  
***************
*** 81,89 ****
      /*
       * Open a socket, or re-use an existing one.
       */
!     if (sock < 0 && (sock = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
! 	msg_warn("socket: %m");
! 	return;
      }
  
      /*
--- 82,93 ----
      /*
       * Open a socket, or re-use an existing one.
       */
!     if (sock < 0) {
! 	if ((sock = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
! 	    msg_warn("socket: %m");
! 	    return;
! 	}
! 	close_on_exec(sock, CLOSE_ON_EXEC);
      }
  
      /*
diff -cr --new-file /var/tmp/postfix-2.6.16/src/smtpd/smtpd_sasl_proto.c ./src/smtpd/smtpd_sasl_proto.c
*** /var/tmp/postfix-2.6.16/src/smtpd/smtpd_sasl_proto.c	Tue Apr 19 19:06:16 2011
--- ./src/smtpd/smtpd_sasl_proto.c	Wed Aug  1 17:34:08 2012
***************
*** 152,157 ****
--- 152,163 ----
  	smtpd_chat_reply(state, "503 5.5.1 Error: authentication not enabled");
  	return (-1);
      }
+ #define IN_MAIL_TRANSACTION(state) ((state)->sender != 0)
+     if (IN_MAIL_TRANSACTION(state)) {
+ 	state->error_mask |= MAIL_ERROR_PROTOCOL;
+ 	smtpd_chat_reply(state, "503 5.5.1 Error: MAIL transaction in progress");
+ 	return (-1);
+     }
      if (smtpd_milters != 0 && (err = milter_other_event(smtpd_milters)) != 0) {
  	if (err[0] == '5') {
  	    state->error_mask |= MAIL_ERROR_POLICY;