With "socketmap" and "tcp" the data is be transmitted in the clear, and +
With "socketmap" and "tcp" the data will be transmitted in the clear, and there is no query access control, so these are generally unsuitable for storing SNI chains. With LDAP and SQL, you should restrict read access and use TLS to protect the sensitive data in transit.
diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5 index f5b1a1e75..cb33ced1b 100644 --- a/postfix/man/man5/postconf.5 +++ b/postfix/man/man5/postconf.5 @@ -13166,7 +13166,7 @@ is then further encoded to yield a single\-line base64 string. Creation of such tables and secure storage (the value includes private key material) are outside the responsibility of Postfix. .PP -With "socketmap" and "tcp" the data is be transmitted in the clear, and +With "socketmap" and "tcp" the data will be transmitted in the clear, and there is no query access control, so these are generally unsuitable for storing SNI chains. With LDAP and SQL, you should restrict read access and use TLS to protect the sensitive data in transit. diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto index fc27af592..dfc4f37f8 100644 --- a/postfix/proto/postconf.proto +++ b/postfix/proto/postconf.proto @@ -17535,7 +17535,7 @@ is then further encoded to yield a single-line base64 string. Creation of such tables and secure storage (the value includes private key material) are outside the responsibility of Postfix. -With "socketmap" and "tcp" the data is be transmitted in the clear, and +
With "socketmap" and "tcp" the data will be transmitted in the clear, and there is no query access control, so these are generally unsuitable for storing SNI chains. With LDAP and SQL, you should restrict read access and use TLS to protect the sensitive data in transit.
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h index e240638f3..9e07af94a 100644 --- a/postfix/src/global/mail_version.h +++ b/postfix/src/global/mail_version.h @@ -20,7 +20,7 @@ * Patches change both the patchlevel and the release date. Snapshots have no * patchlevel; they change the release date only. */ -#define MAIL_RELEASE_DATE "20190914" +#define MAIL_RELEASE_DATE "20190922" #define MAIL_VERSION_NUMBER "3.5" #ifdef SNAPSHOT diff --git a/postfix/src/tlsproxy/tlsproxy.c b/postfix/src/tlsproxy/tlsproxy.c index 9108126ea..f22a8f6e6 100644 --- a/postfix/src/tlsproxy/tlsproxy.c +++ b/postfix/src/tlsproxy/tlsproxy.c @@ -919,13 +919,11 @@ static void tlsp_strategy(TLSP_STATE *state) if (NBBIO_WRITE_PEND(plaintext_buf) > 0) { if (NBBIO_ACTIVE_FLAGS(plaintext_buf) & NBBIO_FLAG_READ) nbbio_disable_readwrite(plaintext_buf); - if ((NBBIO_ACTIVE_FLAGS(plaintext_buf) & NBBIO_FLAG_WRITE) == 0) - nbbio_enable_write(plaintext_buf, state->timeout); + nbbio_enable_write(plaintext_buf, state->timeout); } else if (NBBIO_READ_PEND(plaintext_buf) < NBBIO_BUFSIZE(plaintext_buf)) { if (NBBIO_ACTIVE_FLAGS(plaintext_buf) & NBBIO_FLAG_WRITE) nbbio_disable_readwrite(plaintext_buf); - if ((NBBIO_ACTIVE_FLAGS(plaintext_buf) & NBBIO_FLAG_READ) == 0) - nbbio_enable_read(plaintext_buf, state->timeout); + nbbio_enable_read(plaintext_buf, state->timeout); } else { if (NBBIO_ACTIVE_FLAGS(plaintext_buf)) nbbio_slumber(plaintext_buf, state->timeout); diff --git a/postfix/src/util/nbbio.c b/postfix/src/util/nbbio.c index 0f345ed6b..d8ddfc6f2 100644 --- a/postfix/src/util/nbbio.c +++ b/postfix/src/util/nbbio.c @@ -74,15 +74,17 @@ /* the named buffer pair, closes the stream, and destroys the /* buffer pair. /* -/* nbbio_enable_read() enables a read pseudothread for the -/* named buffer pair. It is an error to enable a read -/* pseudothread while the read buffer is full, or while a read -/* or write pseudothread is still enabled. +/* nbbio_enable_read() enables a read pseudothread (if one +/* does not already exist) for the named buffer pair, and +/* (re)starts the buffer pair's timer. It is an error to enable +/* a read pseudothread while the read buffer is full, or while +/* a write pseudothread is still enabled. /* -/* nbbio_enable_write() enables a write pseudothread for the -/* named buffer pair. It is an error to enable a write -/* pseudothread while the write buffer is empty, or while a -/* read or write pseudothread is still enabled. +/* nbbio_enable_write() enables a write pseudothread (if one +/* does not already exist) for the named buffer pair, and +/* (re)starts the buffer pair's timer. It is an error to enable +/* a write pseudothread while the write buffer is empty, or +/* while a read pseudothread is still enabled. /* /* nbbio_disable_readwrite() disables any read/write pseudothreads /* for the named buffer pair, including timeouts. To ensure @@ -260,7 +262,7 @@ void nbbio_enable_read(NBBIO *np, int timeout) /* * Sanity checks. */ - if (np->flags & NBBIO_MASK_ACTIVE) + if (np->flags & (NBBIO_MASK_ACTIVE & ~NBBIO_FLAG_READ)) msg_panic("%s: socket fd=%d is enabled for %s", myname, np->fd, NBBIO_OP_NAME(np)); if (timeout <= 0) @@ -273,9 +275,11 @@ void nbbio_enable_read(NBBIO *np, int timeout) /* * Enable events. */ - event_enable_read(np->fd, nbbio_event, (void *) np); + if ((np->flags & NBBIO_FLAG_READ) == 0) { + event_enable_read(np->fd, nbbio_event, (void *) np); + np->flags |= NBBIO_FLAG_READ; + } event_request_timer(nbbio_event, (void *) np, timeout); - np->flags |= NBBIO_FLAG_READ; } /* nbbio_enable_write - enable writing from buffer to socket */ @@ -287,11 +291,11 @@ void nbbio_enable_write(NBBIO *np, int timeout) /* * Sanity checks. */ - if (np->flags & NBBIO_MASK_ACTIVE) + if (np->flags & (NBBIO_MASK_ACTIVE & ~NBBIO_FLAG_WRITE)) msg_panic("%s: socket fd=%d is enabled for %s", myname, np->fd, NBBIO_OP_NAME(np)); if (timeout <= 0) - msg_panic("%s: socket fd=%d bad timeout %d", + msg_panic("%s: socket fd=%d: bad timeout %d", myname, np->fd, timeout); if (np->write_pend <= 0) msg_panic("%s: socket fd=%d: empty write buffer", @@ -300,9 +304,11 @@ void nbbio_enable_write(NBBIO *np, int timeout) /* * Enable events. */ - event_enable_write(np->fd, nbbio_event, (void *) np); + if ((np->flags & NBBIO_FLAG_WRITE) == 0) { + event_enable_write(np->fd, nbbio_event, (void *) np); + np->flags |= NBBIO_FLAG_WRITE; + } event_request_timer(nbbio_event, (void *) np, timeout); - np->flags |= NBBIO_FLAG_WRITE; } /* nbbio_disable_readwrite - disable read/write/timer events */