Prereq: "2.5.10"
diff -cr --new-file /var/tmp/postfix-2.5.10/src/global/mail_version.h ./src/global/mail_version.h
*** /var/tmp/postfix-2.5.10/src/global/mail_version.h Mon Mar 22 16:35:19 2010
--- ./src/global/mail_version.h Tue Nov 23 11:21:53 2010
***************
*** 20,27 ****
* Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only.
*/
! #define MAIL_RELEASE_DATE "20100322"
! #define MAIL_VERSION_NUMBER "2.5.10"
#ifdef SNAPSHOT
# define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE
--- 20,27 ----
* Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only.
*/
! #define MAIL_RELEASE_DATE "20101123"
! #define MAIL_VERSION_NUMBER "2.5.11"
#ifdef SNAPSHOT
# define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE
diff -cr --new-file /var/tmp/postfix-2.5.10/HISTORY ./HISTORY
*** /var/tmp/postfix-2.5.10/HISTORY Mon Mar 22 16:05:22 2010
--- ./HISTORY Tue Nov 23 11:23:06 2010
***************
*** 14571,14573 ****
--- 14571,14612 ----
2821 (and 5321) is vague about the VRFY request format, but
spends lots of text on the reply format. File: smtpd/smtpd.c.
+ 20100610
+
+ Bugfix (introduced Postfix 2.2): Postfix no longer appends
+ the system default CA certificates to the lists specified
+ with *_tls_CAfile or with *_tls_CApath. This prevents
+ third-party certificates from getting mail relay permission
+ with the permit_tls_all_clientcerts feature. Unfortunately
+ this may cause compatibility problems with configurations
+ that rely on certificate verification for other purposes.
+ To get the old behavior, specify "tls_append_default_CA =
+ yes". Files: tls/tls_certkey.c, tls/tls_misc.c,
+ global/mail_params.h. proto/postconf.proto, mantools/postlink.
+
+ 20100714
+
+ Compatibility with Postfix < 2.3: fix 20061207 was incomplete
+ (undoing the change to bounce instead of defer after
+ pipe-to-command delivery fails with a signal). Fix by Thomas
+ Arnett. File: global/pipe_command.c.
+
+ 20100827
+
+ Performance: fix for poor smtpd_proxy_filter TCP performance
+ over loopback (127.0.0.1) connections. Problem reported by
+ Mark Martinec. Files: smtpd/smtpd_proxy.c.
+
+ 20101023
+
+ Cleanup: don't apply reject_rhsbl_helo to non-domain forms
+ such as network addresses. This would cause false positives
+ with dbl.spamhaus.org. File: smtpd/smtpd_check.c.
+
+ 20101117
+
+ Bugfix: the "421" reply after Milter error was overruled
+ by Postfix 1.1 code that replied with "503" for RFC 2821
+ compliance. We now make an exception for "final" replies,
+ as permitted by RFC. Solution by Victor Duchovni. File:
+ smtpd/smtpd.c.
diff -cr --new-file /var/tmp/postfix-2.5.10/RELEASE_NOTES ./RELEASE_NOTES
*** /var/tmp/postfix-2.5.10/RELEASE_NOTES Fri Aug 28 20:32:26 2009
--- ./RELEASE_NOTES Tue Nov 23 13:50:13 2010
***************
*** 11,16 ****
--- 11,28 ----
The mail_release_date configuration parameter (format: yyyymmdd)
specifies the release date of a stable release or snapshot release.
+ Incompatibility with Postfix 2.5.11
+ ===================================
+
+ Postfix no longer appends the system-supplied default CA certificates
+ to the lists specified with *_tls_CAfile or with *_tls_CApath. This
+ prevents third-party certificates from getting mail relay permission
+ with the permit_tls_all_clientcerts feature.
+
+ Unfortunately this change may cause compatibility problems when
+ configurations rely on certificate verification for other purposes.
+ Specify "tls_append_default_CA = yes" for backwards compatibility.
+
Incompatibility with Postfix 2.5.3
==================================
diff -cr --new-file /var/tmp/postfix-2.5.10/html/postconf.5.html ./html/postconf.5.html
*** /var/tmp/postfix-2.5.10/html/postconf.5.html Tue May 12 09:50:58 2009
--- ./html/postconf.5.html Tue Jun 15 19:31:57 2010
***************
*** 8542,8547 ****
--- 8542,8551 ----
needed only when the CA certificate is not already present in the
client certificate file.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
Example:
***************
*** 8565,8570 ****
--- 8569,8578 ----
To use this option in chroot mode, this directory (or a copy)
must be inside the chroot jail.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
Example:
***************
*** 10041,10048 ****
Permit the request when the remote SMTP client certificate is
verified successfully. This option must be used only if a special
CA issues the certificates and only this CA is listed as trusted
! CA, otherwise all clients with a recognized certificate would be
! allowed to relay. This feature is available with Postfix version 2.2.
permit_tls_clientcerts
--- 10049,10059 ----
Permit the request when the remote SMTP client certificate is
verified successfully. This option must be used only if a special
CA issues the certificates and only this CA is listed as trusted
! CA. Otherwise, clients with a third-party certificate would also
! be allowed to relay. Specify "tls_append_default_CA = no" when the
! trusted CA is specified with smtpd_tls_CAfile or smtpd_tls_CApath,
! to prevent Postfix from appending the system-supplied default CAs.
! This feature is available with Postfix version 2.2.
permit_tls_clientcerts
***************
*** 11671,11676 ****
--- 11682,11691 ----
certificates of other trusted CAs. You must use this file for the
list of trusted CAs if you want to use chroot-mode.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
Example:
***************
*** 11697,11702 ****
--- 11712,11721 ----
clients might not offer certificates issued by them. Use of this
feature is therefore not recommended.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
Example:
***************
*** 12634,12639 ****
--- 12653,12675 ----
+
tls_append_default_CA
+ (default: no)
+
+ Append the system-supplied default certificate authority
+ certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
+ The default is "no"; this prevents Postfix from trusting third-party
+ certificates and giving them relay permission with
+ permit_tls_all_clientcerts.
+
+ This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8,
+ 2.7.2 and later versions. Specify "tls_append_default_CA = yes" for
+ backwards compatibility, to avoid breaking certificate verification
+ with sites that don't use permit_tls_all_clientcerts.
+
+
+
+
tls_daemon_random_bytes
(default: 32)
diff -cr --new-file /var/tmp/postfix-2.5.10/man/man5/postconf.5 ./man/man5/postconf.5
*** /var/tmp/postfix-2.5.10/man/man5/postconf.5 Sun Jul 27 15:47:10 2008
--- ./man/man5/postconf.5 Tue Jun 15 19:31:57 2010
***************
*** 4822,4827 ****
--- 4822,4831 ----
needed only when the CA certificate is not already present in the
client certificate file.
.PP
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+ .PP
Example:
.PP
.nf
***************
*** 4842,4847 ****
--- 4846,4855 ----
To use this option in chroot mode, this directory (or a copy)
must be inside the chroot jail.
.PP
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+ .PP
Example:
.PP
.nf
***************
*** 6060,6067 ****
Permit the request when the remote SMTP client certificate is
verified successfully. This option must be used only if a special
CA issues the certificates and only this CA is listed as trusted
! CA, otherwise all clients with a recognized certificate would be
! allowed to relay. This feature is available with Postfix version 2.2.
.IP "\fBpermit_tls_clientcerts\fR"
Permit the request when the remote SMTP client certificate
fingerprint is listed in $relay_clientcerts.
--- 6068,6078 ----
Permit the request when the remote SMTP client certificate is
verified successfully. This option must be used only if a special
CA issues the certificates and only this CA is listed as trusted
! CA. Otherwise, clients with a third-party certificate would also
! be allowed to relay. Specify "tls_append_default_CA = no" when the
! trusted CA is specified with smtpd_tls_CAfile or smtpd_tls_CApath,
! to prevent Postfix from appending the system-supplied default CAs.
! This feature is available with Postfix version 2.2.
.IP "\fBpermit_tls_clientcerts\fR"
Permit the request when the remote SMTP client certificate
fingerprint is listed in $relay_clientcerts.
***************
*** 7120,7125 ****
--- 7131,7140 ----
certificates of other trusted CAs. You must use this file for the
list of trusted CAs if you want to use chroot-mode.
.PP
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+ .PP
Example:
.PP
.nf
***************
*** 7144,7149 ****
--- 7159,7168 ----
clients might not offer certificates issued by them. Use of this
feature is therefore not recommended.
.PP
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+ .PP
Example:
.PP
.nf
***************
*** 7842,7847 ****
--- 7861,7877 ----
process initialization will be logged with the default name. Examples
are errors while parsing the command line arguments, and errors
while accessing the Postfix main.cf configuration file.
+ .SH tls_append_default_CA (default: no)
+ Append the system-supplied default certificate authority
+ certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
+ The default is "no"; this prevents Postfix from trusting third-party
+ certificates and giving them relay permission with
+ permit_tls_all_clientcerts.
+ .PP
+ This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8,
+ 2.7.2 and later versions. Specify "tls_append_default_CA = yes" for
+ backwards compatibility, to avoid breaking certificate verification
+ with sites that don't use permit_tls_all_clientcerts.
.SH tls_daemon_random_bytes (default: 32)
The number of pseudo-random bytes that an \fBsmtp\fR(8) or \fBsmtpd\fR(8)
process requests from the \fBtlsmgr\fR(8) server in order to seed its
diff -cr --new-file /var/tmp/postfix-2.5.10/mantools/postlink ./mantools/postlink
*** /var/tmp/postfix-2.5.10/mantools/postlink Tue May 12 09:47:29 2009
--- ./mantools/postlink Tue Jun 15 17:51:05 2010
***************
*** 630,635 ****
--- 630,636 ----
s;\btls_low_cipherlist\b;$&;g;
s;\btls_export_cipherlist\b;$&;g;
s;\btls_null_cipherlist\b;$&;g;
+ s;\btls_append_default_CA\b;$&;g;
s;\bfrozen_delivered_to\b;$&;g;
diff -cr --new-file /var/tmp/postfix-2.5.10/proto/postconf.proto ./proto/postconf.proto
*** /var/tmp/postfix-2.5.10/proto/postconf.proto Sun Jul 27 15:35:55 2008
--- ./proto/postconf.proto Tue Jun 15 19:31:47 2010
***************
*** 4739,4746 ****
Permit the request when the remote SMTP client certificate is
verified successfully. This option must be used only if a special
CA issues the certificates and only this CA is listed as trusted
! CA, otherwise all clients with a recognized certificate would be
! allowed to relay. This feature is available with Postfix version 2.2.
permit_tls_clientcerts
--- 4739,4749 ----
Permit the request when the remote SMTP client certificate is
verified successfully. This option must be used only if a special
CA issues the certificates and only this CA is listed as trusted
! CA. Otherwise, clients with a third-party certificate would also
! be allowed to relay. Specify "tls_append_default_CA = no" when the
! trusted CA is specified with smtpd_tls_CAfile or smtpd_tls_CApath,
! to prevent Postfix from appending the system-supplied default CAs.
! This feature is available with Postfix version 2.2.
permit_tls_clientcerts
***************
*** 8390,8395 ****
--- 8393,8402 ----
certificates of other trusted CAs. You must use this file for the
list of trusted CAs if you want to use chroot-mode.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
Example:
***************
*** 8412,8417 ****
--- 8419,8428 ----
clients might not offer certificates issued by them. Use of this
feature is therefore not recommended.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
Example:
***************
*** 8761,8766 ****
--- 8772,8781 ----
needed only when the CA certificate is not already present in the
client certificate file.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
Example:
***************
*** 8780,8785 ****
--- 8795,8804 ----
To use this option in chroot mode, this directory (or a copy)
must be inside the chroot jail.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
Example:
***************
*** 9067,9072 ****
--- 9086,9104 ----
This feature is available in Postfix 2.2 and later.
+ %PARAM tls_append_default_CA no
+
+ Append the system-supplied default certificate authority
+ certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
+ The default is "no"; this prevents Postfix from trusting third-party
+ certificates and giving them relay permission with
+ permit_tls_all_clientcerts.
+
+ This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8,
+ 2.7.2 and later versions. Specify "tls_append_default_CA = yes" for
+ backwards compatibility, to avoid breaking certificate verification
+ with sites that don't use permit_tls_all_clientcerts.
+
%PARAM tls_random_exchange_name see "postconf -d" output
Name of the pseudo random number generator (PRNG) state file
diff -cr --new-file /var/tmp/postfix-2.5.10/src/global/mail_params.h ./src/global/mail_params.h
*** /var/tmp/postfix-2.5.10/src/global/mail_params.h Tue May 12 09:55:08 2009
--- ./src/global/mail_params.h Tue Jun 15 17:48:23 2010
***************
*** 607,612 ****
--- 607,616 ----
#define DEF_DUP_FILTER_LIMIT 1000
extern int var_dup_filter_limit;
+ #define VAR_TLS_APPEND_DEF_CA "tls_append_default_CA"
+ #define DEF_TLS_APPEND_DEF_CA 0 /* Postfix < 2.8 BC break */
+ extern bool var_tls_append_def_CA;
+
#define VAR_TLS_RAND_EXCH_NAME "tls_random_exchange_name"
#define DEF_TLS_RAND_EXCH_NAME "${data_directory}/prng_exch"
extern char *var_tls_rand_exch_name;
diff -cr --new-file /var/tmp/postfix-2.5.10/src/global/pipe_command.c ./src/global/pipe_command.c
*** /var/tmp/postfix-2.5.10/src/global/pipe_command.c Tue Jan 8 16:01:16 2008
--- ./src/global/pipe_command.c Wed Jul 14 15:14:11 2010
***************
*** 628,634 ****
*/
if (!NORMAL_EXIT_STATUS(wait_status)) {
if (WIFSIGNALED(wait_status)) {
! dsb_unix(why, "5.3.0", log_len ?
log_buf : sys_exits_detail(EX_SOFTWARE)->text,
"Command died with signal %d: \"%s\"%s%s",
WTERMSIG(wait_status), args.command,
--- 628,634 ----
*/
if (!NORMAL_EXIT_STATUS(wait_status)) {
if (WIFSIGNALED(wait_status)) {
! dsb_unix(why, "4.3.0", log_len ?
log_buf : sys_exits_detail(EX_SOFTWARE)->text,
"Command died with signal %d: \"%s\"%s%s",
WTERMSIG(wait_status), args.command,
diff -cr --new-file /var/tmp/postfix-2.5.10/src/smtpd/smtpd.c ./src/smtpd/smtpd.c
*** /var/tmp/postfix-2.5.10/src/smtpd/smtpd.c Mon Mar 22 16:01:15 2010
--- ./src/smtpd/smtpd.c Mon Nov 22 15:58:59 2010
***************
*** 4221,4226 ****
--- 4221,4231 ----
}
/* XXX We use the real client for connect access control. */
if (state->access_denied && cmdp->action != quit_cmd) {
+ /* XXX Exception for Milter override. */
+ if (strncmp(state->access_denied + 1, "21", 2) == 0) {
+ smtpd_chat_reply(state, "%s", state->access_denied);
+ continue;
+ }
smtpd_chat_reply(state, "503 5.7.0 Error: access denied for %s",
state->namaddr); /* RFC 2821 Sec 3.1 */
state->error_count++;
diff -cr --new-file /var/tmp/postfix-2.5.10/src/smtpd/smtpd_check.c ./src/smtpd/smtpd_check.c
*** /var/tmp/postfix-2.5.10/src/smtpd/smtpd_check.c Fri Aug 28 20:27:36 2009
--- ./src/smtpd/smtpd_check.c Mon Nov 22 10:18:47 2010
***************
*** 3702,3708 ****
name);
else {
cpp += 1;
! if (state->helo_name)
status = reject_rbl_domain(state, *cpp, state->helo_name,
SMTPD_NAME_HELO);
}
--- 3702,3709 ----
name);
else {
cpp += 1;
! if (state->helo_name
! && valid_hostname(state->helo_name, DONT_GRIPE))
status = reject_rbl_domain(state, *cpp, state->helo_name,
SMTPD_NAME_HELO);
}
diff -cr --new-file /var/tmp/postfix-2.5.10/src/smtpd/smtpd_proxy.c ./src/smtpd/smtpd_proxy.c
*** /var/tmp/postfix-2.5.10/src/smtpd/smtpd_proxy.c Fri Mar 6 15:42:40 2009
--- ./src/smtpd/smtpd_proxy.c Fri Aug 27 19:48:29 2010
***************
*** 304,309 ****
--- 304,312 ----
}
state->proxy = vstream_fdopen(fd, O_RDWR);
vstream_control(state->proxy, VSTREAM_CTL_PATH, service, VSTREAM_CTL_END);
+ /* Avoid poor performance when TCP MSS > VSTREAM_BUFSIZE. */
+ if (connect_fn == inet_connect)
+ vstream_tweak_tcp(state->proxy);
smtp_timeout_setup(state->proxy, timeout);
/*
diff -cr --new-file /var/tmp/postfix-2.5.10/src/tls/Makefile.in ./src/tls/Makefile.in
*** /var/tmp/postfix-2.5.10/src/tls/Makefile.in Mon Jan 7 20:42:47 2008
--- ./src/tls/Makefile.in Wed Jul 7 05:25:12 2010
***************
*** 101,106 ****
--- 101,107 ----
tls_bio_ops.o: tls.h
tls_bio_ops.o: tls_bio_ops.c
tls_certkey.o: ../../include/argv.h
+ tls_certkey.o: ../../include/mail_params.h
tls_certkey.o: ../../include/msg.h
tls_certkey.o: ../../include/name_code.h
tls_certkey.o: ../../include/name_mask.h
diff -cr --new-file /var/tmp/postfix-2.5.10/src/tls/tls_certkey.c ./src/tls/tls_certkey.c
*** /var/tmp/postfix-2.5.10/src/tls/tls_certkey.c Mon Jun 26 15:57:43 2006
--- ./src/tls/tls_certkey.c Tue Jun 15 17:56:02 2010
***************
*** 67,72 ****
--- 67,76 ----
#include
+ /* Global library. */
+
+ #include
+
/* TLS library. */
#define TLS_INTERNAL
***************
*** 87,93 ****
tls_print_errors();
return (-1);
}
! if (!SSL_CTX_set_default_verify_paths(ctx)) {
msg_info("cannot set certificate verification paths");
tls_print_errors();
return (-1);
--- 91,97 ----
tls_print_errors();
return (-1);
}
! if (var_tls_append_def_CA && !SSL_CTX_set_default_verify_paths(ctx)) {
msg_info("cannot set certificate verification paths");
tls_print_errors();
return (-1);
diff -cr --new-file /var/tmp/postfix-2.5.10/src/tls/tls_misc.c ./src/tls/tls_misc.c
*** /var/tmp/postfix-2.5.10/src/tls/tls_misc.c Tue Jan 8 15:35:08 2008
--- ./src/tls/tls_misc.c Wed Jul 7 07:00:36 2010
***************
*** 13,18 ****
--- 13,19 ----
/* char *var_tls_export_clist;
/* char *var_tls_null_clist;
/* int var_tls_daemon_rand_bytes;
+ /* bool var_tls_append_def_CA;
/*
/* TLS_APPL_STATE *tls_alloc_app_context(ssl_ctx)
/* SSL_CTX *ssl_ctx;
***************
*** 186,191 ****
--- 187,193 ----
char *var_tls_export_clist;
char *var_tls_null_clist;
int var_tls_daemon_rand_bytes;
+ bool var_tls_append_def_CA;
/*
* Index to attach TLScontext pointers to SSL objects, so that they can be
***************
*** 401,406 ****
--- 403,412 ----
VAR_TLS_DAEMON_RAND_BYTES, DEF_TLS_DAEMON_RAND_BYTES, &var_tls_daemon_rand_bytes, 1, 0,
0,
};
+ static const CONFIG_BOOL_TABLE bool_table[] = {
+ VAR_TLS_APPEND_DEF_CA, DEF_TLS_APPEND_DEF_CA, &var_tls_append_def_CA,
+ 0,
+ };
static int init_done;
if (init_done)
***************
*** 409,414 ****
--- 415,421 ----
get_mail_conf_str_table(str_table);
get_mail_conf_int_table(int_table);
+ get_mail_conf_bool_table(bool_table);
}
/* tls_set_ciphers - Set SSL context cipher list */