To extract the public key fingerprint from an X.509 certificate, + you need to extract the public key from the certificate and compute + the appropriate digest of its DER (ASN.1) encoding. With OpenSSL + the "-pubkey" option of the "x509" command extracts the public + key always in "PEM" format. We pipe the result to another OpenSSL + command that converts the key to DER and then to the "dgst" command + to compute the fingerprint.
+ +The actual command to transform the key to DER format depends + on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the + "pkey" command supports all key types. With OpenSSL 0.9.8 and + earlier, the key type is always RSA (nobody uses DSA, and EC + keys are not fully supported by 0.9.8), so the "rsa" command is + used.
++++ # OpenSSL 1.0 with all certificates and SHA-1 fingerprints. + $ openssl x509 -in cert.pem -noout -pubkey | + openssl pkey -pubin -outform DER | + openssl dgst -sha1 -c + (stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 + + # OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. + $ openssl x509 -in cert.pem -noout -pubkey | + openssl rsa -pubin -outform DER | + openssl dgst -md5 -c + (stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50 ++
Note: Postfix 2.9.0–2.9.5 computed the public key + fingerprint incorrectly. To use public-key fingerprints, upgrade + to Postfix 2.9.6 or later.
+The Postfix SMTP server supports 5 distinct cipher security levels *************** *** 1074,1080 **** not checked. Instead, the smtp_tls_fingerprint_cert_match parameter or the "match" attribute in the policy table lists the remote SMTP server certificate fingerprint or ! public key fingerprint (Postfix 2.9 and later).
If certificate fingerprints are exchanged securely, this is the strongest, and least scalable security level. The administrator needs --- 1107,1113 ---- not checked. Instead, the smtp_tls_fingerprint_cert_match parameter or the "match" attribute in the policy table lists the remote SMTP server certificate fingerprint or ! public key fingerprint (Postfix 2.9 and later).
If certificate fingerprints are exchanged securely, this is the strongest, and least scalable security level. The administrator needs *************** *** 1136,1141 **** --- 1169,1207 ---- +
To extract the public key fingerprint from an X.509 certificate, + you need to extract the public key from the certificate and compute + the appropriate digest of its DER (ASN.1) encoding. With OpenSSL + the "-pubkey" option of the "x509" command extracts the public + key always in "PEM" format. We pipe the result to another OpenSSL + command that converts the key to DER and then to the "dgst" command + to compute the fingerprint.
+ +The actual command to transform the key to DER format depends + on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the + "pkey" command supports all key types. With OpenSSL 0.9.8 and + earlier, the key type is always RSA (nobody uses DSA, and EC + keys are not fully supported by 0.9.8), so the "rsa" command is + used.
++++ # OpenSSL 1.0 with all certificates and SHA-1 fingerprints. + $ openssl x509 -in cert.pem -noout -pubkey | + openssl pkey -pubin -outform DER | + openssl dgst -sha1 -c + (stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 + + # OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. + $ openssl x509 -in cert.pem -noout -pubkey | + openssl rsa -pubin -outform DER | + openssl dgst -md5 -c + (stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50 ++
Note: Postfix 2.9.0–2.9.5 computed the public key + fingerprint incorrectly. To use public-key fingerprints, upgrade + to Postfix 2.9.6 or later.
+At the "verify" TLS security level, messages are sent only over diff -cr --new-file /var/tmp/postfix-2.9.5/html/postconf.5.html ./html/postconf.5.html *** /var/tmp/postfix-2.9.5/html/postconf.5.html Tue Apr 24 15:20:56 2012 --- ./html/postconf.5.html Sun Feb 3 15:53:45 2013 *************** *** 8440,8445 **** --- 8440,8449 ---- an appropriate access(5) policy for each client. See RESTRICTION_CLASS_README.
+Note: Postfix 2.9.0–2.9.5 computed the public key + fingerprint incorrectly. To use public-key fingerprints, upgrade + to Postfix 2.9.6 or later.
+This feature is available with Postfix version 2.2.
*************** *** 10895,10905 **** !Public key fingerprints are more difficult to extract, however, ! the SHA-1 public key fingerprint is often present as the value of the ! "Subject Key Identifier" extension in X.509v3 certificates. The Postfix ! SMTP server and client log the peer certificate fingerprint and public ! key fingerprint when TLS loglevel is 1 or higher.
This feature is available in Postfix 2.5 and later.
--- 10899,10945 ---- !To extract the public key fingerprint from an X.509 certificate, ! you need to extract the public key from the certificate and compute ! the appropriate digest of its DER (ASN.1) encoding. With OpenSSL ! the "-pubkey" option of the "x509" command extracts the public ! key always in "PEM" format. We pipe the result to another OpenSSL ! command that converts the key to DER and then to the "dgst" command ! to compute the fingerprint.
! !The actual command to transform the key to DER format depends ! on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the ! "pkey" command supports all key types. With OpenSSL 0.9.8 and ! earlier, the key type is always RSA (nobody uses DSA, and EC ! keys are not fully supported by 0.9.8), so the "rsa" command is ! used.
!!! !! # OpenSSL 1.0 with all certificates and SHA-1 fingerprints. ! $ openssl x509 -in cert.pem -noout -pubkey | ! openssl pkey -pubin -outform DER | ! openssl dgst -sha1 -c ! (stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 !!
!! !! # OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. ! $ openssl x509 -in cert.pem -noout -pubkey | ! openssl rsa -pubin -outform DER | ! openssl dgst -md5 -c ! (stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50 !!
The Postfix SMTP server and client log the peer (leaf) certificate ! fingerprint and public key fingerprint when TLS loglevel is 1 or ! higher.
! !Note: Postfix 2.9.0–2.9.5 computed the public key ! fingerprint incorrectly. To use public-key fingerprints, upgrade ! to Postfix 2.9.6 or later.
This feature is available in Postfix 2.5 and later.
*************** *** 14688,14698 **** !Public key fingerprints are more difficult to extract, however, ! the SHA-1 public key fingerprint is often present as the value of the ! "Subject Key Identifier" extension in X.509v3 certificates. The Postfix ! SMTP server and client log the peer certificate fingerprint and public ! key fingerprint when TLS loglevel is 1 or higher.
Example: client-certificate access table, with sha1 fingerprints:
--- 14728,14774 ---- !To extract the public key fingerprint from an X.509 certificate, ! you need to extract the public key from the certificate and compute ! the appropriate digest of its DER (ASN.1) encoding. With OpenSSL ! the "-pubkey" option of the "x509" command extracts the public ! key always in "PEM" format. We pipe the result to another OpenSSL ! command that converts the key to DER and then to the "dgst" command ! to compute the fingerprint.
! !The actual command to transform the key to DER format depends ! on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the ! "pkey" command supports all key types. With OpenSSL 0.9.8 and ! earlier, the key type is always RSA (nobody uses DSA, and EC ! keys are not fully supported by 0.9.8), so the "rsa" command is ! used.
!!! !! # OpenSSL 1.0 with all certificates and SHA-1 fingerprints. ! $ openssl x509 -in cert.pem -noout -pubkey | ! openssl pkey -pubin -outform DER | ! openssl dgst -sha1 -c ! (stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 !!
!! !! # OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. ! $ openssl x509 -in cert.pem -noout -pubkey | ! openssl rsa -pubin -outform DER | ! openssl dgst -md5 -c ! (stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50 !!
The Postfix SMTP server and client log the peer (leaf) certificate ! fingerprint and public key fingerprint when TLS loglevel is 1 or ! higher.
! !Note: Postfix 2.9.0–2.9.5 computed the public key ! fingerprint incorrectly. To use public-key fingerprints, upgrade ! to Postfix 2.9.6 or later.
Example: client-certificate access table, with sha1 fingerprints:
*************** *** 15587,15592 **** --- 15663,15687 ---- +A temporary migration aid for sites that use certificate + public-key fingerprints with Postfix 2.9.0..2.9.5, which use + an incorrect algorithm. This parameter has no effect on the certificate + fingerprint support that is available since Postfix 2.2.
+ +Specify "tls_legacy_public_key_fingerprints = yes" temporarily, + pending a migration from configuration files with incorrect Postfix + 2.9.0..2.9.5 certificate public-key finger prints, to the correct + fingerprints used by Postfix 2.9.6 and later. To compute the correct + certificate public-key fingerprints, see TLS_README.
+ +This feature is available in Postfix 2.9.6 and later.
+ + +To extract the public key fingerprint from an X.509 certificate, + you need to extract the public key from the certificate and compute + the appropriate digest of its DER (ASN.1) encoding. With OpenSSL + the "-pubkey" option of the "x509" command extracts the public + key always in "PEM" format. We pipe the result to another OpenSSL + command that converts the key to DER and then to the "dgst" command + to compute the fingerprint.
+ +The actual command to transform the key to DER format depends + on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the + "pkey" command supports all key types. With OpenSSL 0.9.8 and + earlier, the key type is always RSA (nobody uses DSA, and EC + keys are not fully supported by 0.9.8), so the "rsa" command is + used.
++++ # OpenSSL 1.0 with all certificates and SHA-1 fingerprints. + $ openssl x509 -in cert.pem -noout -pubkey | + openssl pkey -pubin -outform DER | + openssl dgst -sha1 -c + (stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 + + # OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. + $ openssl x509 -in cert.pem -noout -pubkey | + openssl rsa -pubin -outform DER | + openssl dgst -md5 -c + (stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50 ++
Note: Postfix 2.9.0–2.9.5 computed the public key + fingerprint incorrectly. To use public-key fingerprints, upgrade + to Postfix 2.9.6 or later.
+The Postfix SMTP server supports 5 distinct cipher security levels *************** *** 1074,1080 **** not checked. Instead, the smtp_tls_fingerprint_cert_match parameter or the "match" attribute in the policy table lists the remote SMTP server certificate fingerprint or ! public key fingerprint (Postfix 2.9 and later).
If certificate fingerprints are exchanged securely, this is the strongest, and least scalable security level. The administrator needs --- 1107,1113 ---- not checked. Instead, the smtp_tls_fingerprint_cert_match parameter or the "match" attribute in the policy table lists the remote SMTP server certificate fingerprint or ! public key fingerprint (Postfix 2.9 and later).
If certificate fingerprints are exchanged securely, this is the strongest, and least scalable security level. The administrator needs *************** *** 1136,1141 **** --- 1169,1207 ---- +
To extract the public key fingerprint from an X.509 certificate, + you need to extract the public key from the certificate and compute + the appropriate digest of its DER (ASN.1) encoding. With OpenSSL + the "-pubkey" option of the "x509" command extracts the public + key always in "PEM" format. We pipe the result to another OpenSSL + command that converts the key to DER and then to the "dgst" command + to compute the fingerprint.
+ +The actual command to transform the key to DER format depends + on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the + "pkey" command supports all key types. With OpenSSL 0.9.8 and + earlier, the key type is always RSA (nobody uses DSA, and EC + keys are not fully supported by 0.9.8), so the "rsa" command is + used.
++++ # OpenSSL 1.0 with all certificates and SHA-1 fingerprints. + $ openssl x509 -in cert.pem -noout -pubkey | + openssl pkey -pubin -outform DER | + openssl dgst -sha1 -c + (stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 + + # OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. + $ openssl x509 -in cert.pem -noout -pubkey | + openssl rsa -pubin -outform DER | + openssl dgst -md5 -c + (stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50 ++
Note: Postfix 2.9.0–2.9.5 computed the public key + fingerprint incorrectly. To use public-key fingerprints, upgrade + to Postfix 2.9.6 or later.
+At the "verify" TLS security level, messages are sent only over diff -cr --new-file /var/tmp/postfix-2.9.5/proto/postconf.proto ./proto/postconf.proto *** /var/tmp/postfix-2.9.5/proto/postconf.proto Tue Apr 24 13:07:22 2012 --- ./proto/postconf.proto Sun Feb 3 15:53:34 2013 *************** *** 9065,9070 **** --- 9065,9074 ---- an appropriate access(5) policy for each client. See RESTRICTION_CLASS_README.
+Note: Postfix 2.9.0–2.9.5 computed the public key + fingerprint incorrectly. To use public-key fingerprints, upgrade + to Postfix 2.9.6 or later.
+This feature is available with Postfix version 2.2.
%PARAM smtpd_tls_cipherlist *************** *** 11489,11499 **** !Public key fingerprints are more difficult to extract, however, ! the SHA-1 public key fingerprint is often present as the value of the ! "Subject Key Identifier" extension in X.509v3 certificates. The Postfix ! SMTP server and client log the peer certificate fingerprint and public ! key fingerprint when TLS loglevel is 1 or higher.
This feature is available in Postfix 2.5 and later.
--- 11493,11539 ---- !To extract the public key fingerprint from an X.509 certificate, ! you need to extract the public key from the certificate and compute ! the appropriate digest of its DER (ASN.1) encoding. With OpenSSL ! the "-pubkey" option of the "x509" command extracts the public ! key always in "PEM" format. We pipe the result to another OpenSSL ! command that converts the key to DER and then to the "dgst" command ! to compute the fingerprint.
! !The actual command to transform the key to DER format depends ! on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the ! "pkey" command supports all key types. With OpenSSL 0.9.8 and ! earlier, the key type is always RSA (nobody uses DSA, and EC ! keys are not fully supported by 0.9.8), so the "rsa" command is ! used.
!!! !! # OpenSSL 1.0 with all certificates and SHA-1 fingerprints. ! $ openssl x509 -in cert.pem -noout -pubkey | ! openssl pkey -pubin -outform DER | ! openssl dgst -sha1 -c ! (stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 !!
!! !! # OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. ! $ openssl x509 -in cert.pem -noout -pubkey | ! openssl rsa -pubin -outform DER | ! openssl dgst -md5 -c ! (stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50 !!
The Postfix SMTP server and client log the peer (leaf) certificate ! fingerprint and public key fingerprint when TLS loglevel is 1 or ! higher.
! !Note: Postfix 2.9.0–2.9.5 computed the public key ! fingerprint incorrectly. To use public-key fingerprints, upgrade ! to Postfix 2.9.6 or later.
This feature is available in Postfix 2.5 and later.
*************** *** 11607,11617 **** !Public key fingerprints are more difficult to extract, however, ! the SHA-1 public key fingerprint is often present as the value of the ! "Subject Key Identifier" extension in X.509v3 certificates. The Postfix ! SMTP server and client log the peer certificate fingerprint and public ! key fingerprint when TLS loglevel is 1 or higher.
Example: client-certificate access table, with sha1 fingerprints:
--- 11647,11693 ---- !To extract the public key fingerprint from an X.509 certificate, ! you need to extract the public key from the certificate and compute ! the appropriate digest of its DER (ASN.1) encoding. With OpenSSL ! the "-pubkey" option of the "x509" command extracts the public ! key always in "PEM" format. We pipe the result to another OpenSSL ! command that converts the key to DER and then to the "dgst" command ! to compute the fingerprint.
! !The actual command to transform the key to DER format depends ! on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the ! "pkey" command supports all key types. With OpenSSL 0.9.8 and ! earlier, the key type is always RSA (nobody uses DSA, and EC ! keys are not fully supported by 0.9.8), so the "rsa" command is ! used.
!!! !! # OpenSSL 1.0 with all certificates and SHA-1 fingerprints. ! $ openssl x509 -in cert.pem -noout -pubkey | ! openssl pkey -pubin -outform DER | ! openssl dgst -sha1 -c ! (stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 !!
!! !! # OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. ! $ openssl x509 -in cert.pem -noout -pubkey | ! openssl rsa -pubin -outform DER | ! openssl dgst -md5 -c ! (stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50 !!
The Postfix SMTP server and client log the peer (leaf) certificate ! fingerprint and public key fingerprint when TLS loglevel is 1 or ! higher.
! !Note: Postfix 2.9.0–2.9.5 computed the public key ! fingerprint incorrectly. To use public-key fingerprints, upgrade ! to Postfix 2.9.6 or later.
Example: client-certificate access table, with sha1 fingerprints:
*************** *** 13869,13874 **** --- 13945,13965 ----This feature is available in Postfix 2.8 and later.
+ %PARAM tls_legacy_public_key_fingerprints no + +A temporary migration aid for sites that use certificate + public-key fingerprints with Postfix 2.9.0..2.9.5, which use + an incorrect algorithm. This parameter has no effect on the certificate + fingerprint support that is available since Postfix 2.2.
+ +Specify "tls_legacy_public_key_fingerprints = yes" temporarily, + pending a migration from configuration files with incorrect Postfix + 2.9.0..2.9.5 certificate public-key finger prints, to the correct + fingerprints used by Postfix 2.9.6 and later. To compute the correct + certificate public-key fingerprints, see TLS_README.
+ +This feature is available in Postfix 2.9.6 and later.
+ %PARAM tlsproxy_watchdog_timeout 10s How much time a tlsproxy(8) process may take to process local
diff -cr --new-file /var/tmp/postfix-2.9.5/src/global/mail_params.h ./src/global/mail_params.h
*** /var/tmp/postfix-2.9.5/src/global/mail_params.h Tue Apr 24 13:07:22 2012
--- ./src/global/mail_params.h Sun Feb 3 14:49:54 2013
***************
*** 3035,3040 ****
--- 3035,3044 ----
#define DEF_TLS_BUG_TWEAKS TLS_BUG_TWEAKS
extern char *var_tls_bug_tweaks;
+ #define VAR_TLS_BC_PKEY_FPRINT "tls_legacy_public_key_fingerprints"
+ #define DEF_TLS_BC_PKEY_FPRINT 0
+ extern bool var_tls_bc_pkey_fprint;
+
/*
* Sendmail-style mail filter support.
*/
diff -cr --new-file /var/tmp/postfix-2.9.5/src/postconf/Makefile.in ./src/postconf/Makefile.in
*** /var/tmp/postfix-2.9.5/src/postconf/Makefile.in Sun Jan 22 10:55:21 2012
--- ./src/postconf/Makefile.in Sat Jan 5 14:59:51 2013
***************
*** 42,48 ****
tests: test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 test11 \
test12 test13 test14 test15 test16 test17 test18 test19 test20 test21 \
! test22 test23 test24 test25 test26 test27 test28 test29 test30
root_tests:
--- 42,48 ----
tests: test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 test11 \
test12 test13 test14 test15 test16 test17 test18 test19 test20 test21 \
! test22 test23 test24 test25 test26 test27 test28 test29 test30 test40
root_tests:
***************
*** 414,419 ****
--- 414,430 ----
diff test30.ref test30.tmp
rm -f main.cf master.cf test30.tmp
+ test40: $(PROG) test40.ref
+ rm -f main.cf master.cf
+ touch main.cf master.cf
+ echo foo unix - n n - 0 other >> master.cf
+ echo ' -voaaa=bbb' >> master.cf
+ echo ' -vo ccc=$$aaa' >> master.cf
+ echo ' -v -oddd=$$ccc' >> master.cf
+ ./$(PROG) -Mfc . unix >test40.tmp 2>&1
+ diff test40.ref test40.tmp
+ rm -f main.cf master.cf test40.tmp
+
printfck: $(OBJS) $(PROG)
rm -rf printfck
mkdir printfck
diff -cr --new-file /var/tmp/postfix-2.9.5/src/postconf/postconf_master.c ./src/postconf/postconf_master.c
*** /var/tmp/postfix-2.9.5/src/postconf/postconf_master.c Sat Jan 21 16:11:38 2012
--- ./src/postconf/postconf_master.c Mon Dec 31 16:23:52 2012
***************
*** 74,79 ****
--- 74,81 ----
{
int field;
char *arg;
+ char *cp;
+ char *junk;
/*
* Normalize options to simplify later processing.
***************
*** 82,87 ****
--- 84,99 ----
arg = argv->argv[field];
if (arg[0] != '-' || strcmp(arg, "--") == 0)
break;
+ for (cp = arg + 1; *cp; cp++) {
+ if (*cp == 'o' && cp > arg + 1) {
+ /* Split "-stuffo" into "-stuff" and "-o". */
+ junk = concatenate("-", cp, (char *) 0);
+ argv_insert_one(argv, field + 1, junk);
+ myfree(junk);
+ *cp = 0;
+ break;
+ }
+ }
if (strncmp(arg, "-o", 2) == 0) {
if (arg[2] != 0) {
/* Split "-oname=value" into "-o" "name=value". */
diff -cr --new-file /var/tmp/postfix-2.9.5/src/postconf/test40.ref ./src/postconf/test40.ref
*** /var/tmp/postfix-2.9.5/src/postconf/test40.ref Wed Dec 31 19:00:00 1969
--- ./src/postconf/test40.ref Mon Dec 31 16:32:31 2012
***************
*** 0 ****
--- 1,4 ----
+ foo unix - n n - 0 other -v
+ -o aaa=bbb -v
+ -o ccc=$aaa -v
+ -o ddd=$ccc
diff -cr --new-file /var/tmp/postfix-2.9.5/src/tls/Makefile.in ./src/tls/Makefile.in
*** /var/tmp/postfix-2.9.5/src/tls/Makefile.in Sun Jan 22 10:55:15 2012
--- ./src/tls/Makefile.in Sun Feb 3 15:17:01 2013
***************
*** 319,324 ****
--- 319,325 ----
tls_stream.o: tls.h
tls_stream.o: tls_stream.c
tls_verify.o: ../../include/argv.h
+ tls_verify.o: ../../include/mail_params.h
tls_verify.o: ../../include/msg.h
tls_verify.o: ../../include/mymalloc.h
tls_verify.o: ../../include/name_code.h
diff -cr --new-file /var/tmp/postfix-2.9.5/src/tls/tls_misc.c ./src/tls/tls_misc.c
*** /var/tmp/postfix-2.9.5/src/tls/tls_misc.c Sun Apr 22 18:08:04 2012
--- ./src/tls/tls_misc.c Sun Feb 3 14:58:42 2013
***************
*** 17,22 ****
--- 17,23 ----
/* int var_tls_daemon_rand_bytes;
/* bool var_tls_append_def_CA;
/* bool var_tls_preempt_clist;
+ /* bool var_tls_bc_pkey_fprint;
/*
/* TLS_APPL_STATE *tls_alloc_app_context(ssl_ctx, log_mask)
/* SSL_CTX *ssl_ctx;
***************
*** 205,210 ****
--- 206,212 ----
char *var_tls_eecdh_ultra;
bool var_tls_append_def_CA;
char *var_tls_bug_tweaks;
+ bool var_tls_bc_pkey_fprint;
#ifdef VAR_TLS_PREEMPT_CLIST
bool var_tls_preempt_clist;
***************
*** 510,517 ****
else
include |= code =
name_code(protocol_table, NAME_CODE_FLAG_NONE, tok);
! if (code == TLS_PROTOCOL_INVALID)
return TLS_PROTOCOL_INVALID;
}
myfree(save);
--- 512,521 ----
else
include |= code =
name_code(protocol_table, NAME_CODE_FLAG_NONE, tok);
! if (code == TLS_PROTOCOL_INVALID) {
! myfree(save);
return TLS_PROTOCOL_INVALID;
+ }
}
myfree(save);
***************
*** 546,551 ****
--- 550,556 ----
};
static const CONFIG_BOOL_TABLE bool_table[] = {
VAR_TLS_APPEND_DEF_CA, DEF_TLS_APPEND_DEF_CA, &var_tls_append_def_CA,
+ VAR_TLS_BC_PKEY_FPRINT, DEF_TLS_BC_PKEY_FPRINT, &var_tls_bc_pkey_fprint,
#if OPENSSL_VERSION_NUMBER >= 0x0090700fL /* OpenSSL 0.9.7 and later */
VAR_TLS_PREEMPT_CLIST, DEF_TLS_PREEMPT_CLIST, &var_tls_preempt_clist,
#endif
diff -cr --new-file /var/tmp/postfix-2.9.5/src/tls/tls_verify.c ./src/tls/tls_verify.c
*** /var/tmp/postfix-2.9.5/src/tls/tls_verify.c Mon Dec 5 16:03:07 2011
--- ./src/tls/tls_verify.c Sun Feb 3 14:49:54 2013
***************
*** 23,28 ****
--- 23,32 ----
/* X509 *peercert;
/* const char *dgst;
/*
+ /* char *tls_pkey_fprint(peercert, dgst)
+ /* X509 *peercert;
+ /* const char *dgst;
+ /*
/* int tls_verify_certificate_callback(ok, ctx)
/* int ok;
/* X509_STORE_CTX *ctx;
***************
*** 50,55 ****
--- 54,64 ----
/* value is dynamically allocated with mymalloc(), and the caller
/* must eventually free it with myfree().
/*
+ /* tls_pkey_fprint() returns a public-key fingerprint; in all
+ /* other respects the function behaves as tls_fingerprint().
+ /* The var_tls_bc_pkey_fprint variable enables an incorrect
+ /* algorithm that was used in Postfix versions 2.9.[0-5].
+ /*
/* tls_verify_callback() is called several times (directly or
/* indirectly) from crypto/x509/x509_vfy.c. It is called as
/* a final check, and if it returns "0", the handshake is
***************
*** 140,145 ****
--- 149,158 ----
#include