mir/postfix
2
0
Fork 0
mirror of https://github.com/vdukhovni/postfix synced 2025-08-28 12:48:01 +00:00
Code Issues Releases Wiki Activity

postfix-3.5-20190922

Browse Source
This commit is contained in:
Wietse Venema 2019-09-22 00:00:00 -05:00 committed by Viktor Dukhovni
parent b0a41c6c21
commit 142d2a788f
8 changed files with 47 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
postfix/HISTORY
View File

@ -24190,12 +24190,12 @@ Apologies for any names omitted.
TLS library overhaul. By intrigeri. File: tls/tls_dane.c. TLS library overhaul. By intrigeri. File: tls/tls_dane.c.
Bugfix (introduced: Postfix-1.0.1): null pointer read, while Bugfix (introduced: Postfix-1.0.1): null pointer read, while
logging a warning after a corrupted bounce log file. File: logging a warning after reading a corrupted bounce log file.
global/bounce_log.c. File: global/bounce_log.c.
Bugfix (introduced: Postfix-2.9.0): null pointer read, while Bugfix (introduced: Postfix-2.9.0): null pointer read, while
logging a warning after a postscreen_command_filter read logging a warning after a postscreen_command_filter read
error. File: postscreen/postscreen_smtpd.c. global/bounce_log.c error. File: postscreen/postscreen_smtpd.c.
20190312 20190312
@ -24372,9 +24372,9 @@ Apologies for any names omitted.
hides application performance bugs, and because that still hides application performance bugs, and because that still
suffers from server-side delayed ACKs. Instead, Postfix suffers from server-side delayed ACKs. Instead, Postfix
avoids sending "small" writes back-to-back, by choosing a avoids sending "small" writes back-to-back, by choosing a
VSTREAM buffer size that is a multiple of the reported VSTREAM buffer size that is a multiple of the reported MSS.
MSS. This workaround bumps the multiplier from 2x to 4x. This workaround bumps the multiplier from 2x to 4x. File:
File: util/vstream_tweak.c. util/vstream_tweak.c.
20190825 20190825
@ -24382,7 +24382,7 @@ Apologies for any names omitted.
segfault (null pointer read) or cause an SMTP server assertion segfault (null pointer read) or cause an SMTP server assertion
to fail when talking to a fake Dovecot server. The client to fail when talking to a fake Dovecot server. The client
now logs a proper error instead. Problem reported by Tim now logs a proper error instead. Problem reported by Tim
Düsterhus. File: xsasl/xsasl_dovecot_server.c. Düsterhus. File: xsasl/xsasl_dovecot_server.c.
20190908 20190908
@ -24398,8 +24398,16 @@ Apologies for any names omitted.
log with error messages (see below for a specific case). log with error messages (see below for a specific case).
Problem reported by Andreas Schulze. File: tlsproxy/tlsproxy.c. Problem reported by Andreas Schulze. File: tlsproxy/tlsproxy.c.
Bitrot: don't invoke SSL_shutdown() when the SSL engine thinks Bitrot: don't invoke SSL_shutdown() when the SSL engine
that it is processing a TLS handshake. With the change at thinks it is processing a TLS handshake. The commit at
https://github.com/openssl/openssl/commit/64193c8218540499984cd63cda41f3cd491f3f59, https://github.com/openssl/openssl/commit/64193c8218540499984cd63cda41f3cd491f3f59
the error status was changed, incompatibly, from SSL_ERROR_NONE changed the error status, incompatibly, from SSL_ERROR_NONE
into SSL_ERROR_SSL. File: tlsproxy/tlsproxxy.c. into SSL_ERROR_SSL. File: tlsproxy/tlsproxxy.c.
20190918
Cleanup: the nbbio(3) library now accepts a sequence of
nbbio_enable_read() calls or a sequence of nbbio_enable_write()
calls. This allows tlsproxy(8) to reset an I/O timer after
each event without having to make an nbbio_disable_readwrite()
call. Files: util/nbbio.c, tlsproxy/tlsproxy.c.

10
postfix/WISHLIST
View File

@ -1,14 +1,6 @@
Wish list: Wish list:
NBBIO timers can go off when a single nbbio_enable_xxx() nbbio: exercise the sanity checks with fake msg(3) functions.
call is followed by a continuous sequence of events. This
has not been a problem in tlsproxy because the plaintext
stream moves data faster than the ciphertext stream, so
that plaintext events will happen in bursts instead of a
long continuous sequence. Fix: allow calling nbbio_enable_xxx()
when events of type 'xxx' are already enabled. Then
nbbio_enable_xxx() can skip the event_enable_xxx() call
before calling event_request_timer().
transport policy protocol (clone of check_policy). transport policy protocol (clone of check_policy).

2
postfix/html/postconf.5.html
View File

@ -18833,7 +18833,7 @@ is then further encoded to yield a single-line base64 string.
Creation of such tables and secure storage (the value includes Creation of such tables and secure storage (the value includes
private key material) are outside the responsibility of Postfix. </p> private key material) are outside the responsibility of Postfix. </p>
<p> With "socketmap" and "tcp" the data is be transmitted in the clear, and <p> With "socketmap" and "tcp" the data will be transmitted in the clear, and
there is no query access control, so these are generally unsuitable for storing there is no query access control, so these are generally unsuitable for storing
SNI chains. With LDAP and SQL, you should restrict read access and use TLS to SNI chains. With LDAP and SQL, you should restrict read access and use TLS to
protect the sensitive data in transit. </p> protect the sensitive data in transit. </p>

2
postfix/man/man5/postconf.5
View File

@ -13166,7 +13166,7 @@ is then further encoded to yield a single\-line base64 string.
Creation of such tables and secure storage (the value includes Creation of such tables and secure storage (the value includes
private key material) are outside the responsibility of Postfix. private key material) are outside the responsibility of Postfix.
.PP .PP
With "socketmap" and "tcp" the data is be transmitted in the clear, and With "socketmap" and "tcp" the data will be transmitted in the clear, and
there is no query access control, so these are generally unsuitable for storing there is no query access control, so these are generally unsuitable for storing
SNI chains. With LDAP and SQL, you should restrict read access and use TLS to SNI chains. With LDAP and SQL, you should restrict read access and use TLS to
protect the sensitive data in transit. protect the sensitive data in transit.

2
postfix/proto/postconf.proto
View File

@ -17535,7 +17535,7 @@ is then further encoded to yield a single-line base64 string.
Creation of such tables and secure storage (the value includes Creation of such tables and secure storage (the value includes
private key material) are outside the responsibility of Postfix. </p> private key material) are outside the responsibility of Postfix. </p>
<p> With "socketmap" and "tcp" the data is be transmitted in the clear, and <p> With "socketmap" and "tcp" the data will be transmitted in the clear, and
there is no query access control, so these are generally unsuitable for storing there is no query access control, so these are generally unsuitable for storing
SNI chains. With LDAP and SQL, you should restrict read access and use TLS to SNI chains. With LDAP and SQL, you should restrict read access and use TLS to
protect the sensitive data in transit. </p> protect the sensitive data in transit. </p>

2
postfix/src/global/mail_version.h
View File

@ -20,7 +20,7 @@
* Patches change both the patchlevel and the release date. Snapshots have no * Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only. * patchlevel; they change the release date only.
*/ */
#define MAIL_RELEASE_DATE "20190914" #define MAIL_RELEASE_DATE "20190922"
#define MAIL_VERSION_NUMBER "3.5" #define MAIL_VERSION_NUMBER "3.5"
#ifdef SNAPSHOT #ifdef SNAPSHOT

6
postfix/src/tlsproxy/tlsproxy.c
View File

@ -919,13 +919,11 @@ static void tlsp_strategy(TLSP_STATE *state)
if (NBBIO_WRITE_PEND(plaintext_buf) > 0) { if (NBBIO_WRITE_PEND(plaintext_buf) > 0) {
if (NBBIO_ACTIVE_FLAGS(plaintext_buf) & NBBIO_FLAG_READ) if (NBBIO_ACTIVE_FLAGS(plaintext_buf) & NBBIO_FLAG_READ)
nbbio_disable_readwrite(plaintext_buf); nbbio_disable_readwrite(plaintext_buf);
if ((NBBIO_ACTIVE_FLAGS(plaintext_buf) & NBBIO_FLAG_WRITE) == 0) nbbio_enable_write(plaintext_buf, state->timeout);
nbbio_enable_write(plaintext_buf, state->timeout);
} else if (NBBIO_READ_PEND(plaintext_buf) < NBBIO_BUFSIZE(plaintext_buf)) { } else if (NBBIO_READ_PEND(plaintext_buf) < NBBIO_BUFSIZE(plaintext_buf)) {
if (NBBIO_ACTIVE_FLAGS(plaintext_buf) & NBBIO_FLAG_WRITE) if (NBBIO_ACTIVE_FLAGS(plaintext_buf) & NBBIO_FLAG_WRITE)
nbbio_disable_readwrite(plaintext_buf); nbbio_disable_readwrite(plaintext_buf);
if ((NBBIO_ACTIVE_FLAGS(plaintext_buf) & NBBIO_FLAG_READ) == 0) nbbio_enable_read(plaintext_buf, state->timeout);
nbbio_enable_read(plaintext_buf, state->timeout);
} else { } else {
if (NBBIO_ACTIVE_FLAGS(plaintext_buf)) if (NBBIO_ACTIVE_FLAGS(plaintext_buf))
nbbio_slumber(plaintext_buf, state->timeout); nbbio_slumber(plaintext_buf, state->timeout);

36
postfix/src/util/nbbio.c
View File

@ -74,15 +74,17 @@
/* the named buffer pair, closes the stream, and destroys the /* the named buffer pair, closes the stream, and destroys the
/* buffer pair. /* buffer pair.
/* /*
/* nbbio_enable_read() enables a read pseudothread for the /* nbbio_enable_read() enables a read pseudothread (if one
/* named buffer pair. It is an error to enable a read /* does not already exist) for the named buffer pair, and
/* pseudothread while the read buffer is full, or while a read /* (re)starts the buffer pair's timer. It is an error to enable
/* or write pseudothread is still enabled. /* a read pseudothread while the read buffer is full, or while
/* a write pseudothread is still enabled.
/* /*
/* nbbio_enable_write() enables a write pseudothread for the /* nbbio_enable_write() enables a write pseudothread (if one
/* named buffer pair. It is an error to enable a write /* does not already exist) for the named buffer pair, and
/* pseudothread while the write buffer is empty, or while a /* (re)starts the buffer pair's timer. It is an error to enable
/* read or write pseudothread is still enabled. /* a write pseudothread while the write buffer is empty, or
/* while a read pseudothread is still enabled.
/* /*
/* nbbio_disable_readwrite() disables any read/write pseudothreads /* nbbio_disable_readwrite() disables any read/write pseudothreads
/* for the named buffer pair, including timeouts. To ensure /* for the named buffer pair, including timeouts. To ensure
@ -260,7 +262,7 @@ void nbbio_enable_read(NBBIO *np, int timeout)
/* /*
* Sanity checks. * Sanity checks.
*/ */
if (np->flags & NBBIO_MASK_ACTIVE) if (np->flags & (NBBIO_MASK_ACTIVE & ~NBBIO_FLAG_READ))
msg_panic("%s: socket fd=%d is enabled for %s", msg_panic("%s: socket fd=%d is enabled for %s",
myname, np->fd, NBBIO_OP_NAME(np)); myname, np->fd, NBBIO_OP_NAME(np));
if (timeout <= 0) if (timeout <= 0)
@ -273,9 +275,11 @@ void nbbio_enable_read(NBBIO *np, int timeout)
/* /*
* Enable events. * Enable events.
*/ */
event_enable_read(np->fd, nbbio_event, (void *) np); if ((np->flags & NBBIO_FLAG_READ) == 0) {
event_enable_read(np->fd, nbbio_event, (void *) np);
np->flags |= NBBIO_FLAG_READ;
}
event_request_timer(nbbio_event, (void *) np, timeout); event_request_timer(nbbio_event, (void *) np, timeout);
np->flags |= NBBIO_FLAG_READ;
} }
/* nbbio_enable_write - enable writing from buffer to socket */ /* nbbio_enable_write - enable writing from buffer to socket */
@ -287,11 +291,11 @@ void nbbio_enable_write(NBBIO *np, int timeout)
/* /*
* Sanity checks. * Sanity checks.
*/ */
if (np->flags & NBBIO_MASK_ACTIVE) if (np->flags & (NBBIO_MASK_ACTIVE & ~NBBIO_FLAG_WRITE))
msg_panic("%s: socket fd=%d is enabled for %s", msg_panic("%s: socket fd=%d is enabled for %s",
myname, np->fd, NBBIO_OP_NAME(np)); myname, np->fd, NBBIO_OP_NAME(np));
if (timeout <= 0) if (timeout <= 0)
msg_panic("%s: socket fd=%d bad timeout %d", msg_panic("%s: socket fd=%d: bad timeout %d",
myname, np->fd, timeout); myname, np->fd, timeout);
if (np->write_pend <= 0) if (np->write_pend <= 0)
msg_panic("%s: socket fd=%d: empty write buffer", msg_panic("%s: socket fd=%d: empty write buffer",
@ -300,9 +304,11 @@ void nbbio_enable_write(NBBIO *np, int timeout)
/* /*
* Enable events. * Enable events.
*/ */
event_enable_write(np->fd, nbbio_event, (void *) np); if ((np->flags & NBBIO_FLAG_WRITE) == 0) {
event_enable_write(np->fd, nbbio_event, (void *) np);
np->flags |= NBBIO_FLAG_WRITE;
}
event_request_timer(nbbio_event, (void *) np, timeout); event_request_timer(nbbio_event, (void *) np, timeout);
np->flags |= NBBIO_FLAG_WRITE;
} }
/* nbbio_disable_readwrite - disable read/write/timer events */ /* nbbio_disable_readwrite - disable read/write/timer events */