postfix-3.9-20231212

postfix/HISTORY

@@ -27603,3 +27603,10 @@ Apologies for any names omitted.
 	Feature: the pipe(8) delivery agent supports an ${envid}
 	command-line attribute that expands to the RFC 3461 envelope
 	ID if available. File: pipe/pipe.c.
+
+20231211
+
+	Cleanup: posttls-finger certificate match expectations for
+	all TLS security levels, including warnings for levels that
+	don't implement certificate matching. Viktor Dukhovni.
+	File: posttls-finger.c.

postfix/src/global/mail_version.h

@@ -20,7 +20,7 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20231210"
+#define MAIL_RELEASE_DATE	"20231212"
 #define MAIL_VERSION_NUMBER	"3.9"
 
 #ifdef SNAPSHOT

postfix/src/posttls-finger/posttls-finger.c

@@ -2145,8 +2145,12 @@ static void parse_match(STATE *state, int argc, char *argv[])
     switch (state->level) {
     default:
 	state->match = 0;
+	if (*argv)
+	    msg_warn("TLS level '%s' does not implement certificate matching",
+		     str_tls_level(state->level));
 	break;
     case TLS_LEV_DANE:
+    case TLS_LEV_DANE_ONLY:
     case TLS_LEV_SECURE:
 	state->match = argv_alloc(2);
 	while (*argv)