diff --git a/postfix/HISTORY b/postfix/HISTORY index 959d9afc9..3234dffae 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -27184,3 +27184,31 @@ Apologies for any names omitted. This problem was reported first in the context of TLSA record lookups. Files: util/valid_hostname.[hc], dns/dns_lookup.c. + +20230929 + + Bugfix (defect introduced Postfix 2.5, 20080104): the Postfix + SMTP server was waiting for a client command instead of + replying immediately, after a client certificate verification + error in TLS wrappermode. Reported by Andreas Kinzler. File: + smtpd/smtpd.c. + +20231006 + + Usability: the Postfix SMTP server now attempts to log the + SASL username after authentication failure. In Postfix + logging, this appends ", sasl_username=xxx" after the reason + for SASL authentication failure. The logging replaces an + unavailable reason with "(reason unavailable)", and replaces + an unavailable sasl_username with "(unavailable)". Based + on code by Jozsef Kadlecsik. Files: xsasl/xsasl_server.c, + xsasl/xsasl_cyrus_server.c, smtpd/smtpd_sasl_glue.c. + +20231026 + + Bugfix (defect introduced: Postfix 2.11): in forward_path, + the expression ${recipient_delimiter} would expand to an + empty string when a recipient address had no recipient + delimiter. Fixed by restoring Postfix 2.10 behavior to use + a configured recipient delimiter value. Reported by Tod + A. Sandman. Files: proto/postconf.proto, local/local_expand.c. diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html index f94385236..62f451be0 100644 --- a/postfix/html/postconf.5.html +++ b/postfix/html/postconf.5.html @@ -3761,7 +3761,10 @@ filtered with the character set that is specified with the
$recipient_delimiter
The address extension delimiter that was found in the recipient -address (Postfix 2.11 and later), or the system-wide recipient +address (Postfix 2.11 and later), or the 'first' delimiter specified +with the system-wide recipient address extension delimiter (Postfix +3.5.22, 3.5.12, 3.7.8, 3.8.3 and later). Historically, this was +always the system-wide recipient address extension delimiter (Postfix 2.10 and earlier).
${name?value}
diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5 index 0c9e3ef53..039d2fb65 100644 --- a/postfix/man/man5/postconf.5 +++ b/postfix/man/man5/postconf.5 @@ -2388,7 +2388,10 @@ The entire recipient localpart. .br .IP "\fB$recipient_delimiter\fR" The address extension delimiter that was found in the recipient -address (Postfix 2.11 and later), or the system\-wide recipient +address (Postfix 2.11 and later), or the 'first' delimiter specified +with the system\-wide recipient address extension delimiter (Postfix +3.5.22, 3.5.12, 3.7.8, 3.8.3 and later). Historically, this was +always the system\-wide recipient address extension delimiter (Postfix 2.10 and earlier). .br .IP "\fB${name?value}\fR" diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto index 0112c70d2..ef6c420fb 100644 --- a/postfix/proto/postconf.proto +++ b/postfix/proto/postconf.proto @@ -1764,7 +1764,10 @@ forward_expansion_filter parameter.

$recipient_delimiter
The address extension delimiter that was found in the recipient -address (Postfix 2.11 and later), or the system-wide recipient +address (Postfix 2.11 and later), or the 'first' delimiter specified +with the system-wide recipient address extension delimiter (Postfix +3.5.22, 3.5.12, 3.7.8, 3.8.3 and later). Historically, this was +always the system-wide recipient address extension delimiter (Postfix 2.10 and earlier).
${name?value}
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h index 5045613f1..03c5b3b4e 100644 --- a/postfix/src/global/mail_version.h +++ b/postfix/src/global/mail_version.h @@ -20,8 +20,8 @@ * Patches change both the patchlevel and the release date. Snapshots have no * patchlevel; they change the release date only. */ -#define MAIL_RELEASE_DATE "20230901" -#define MAIL_VERSION_NUMBER "3.8.2" +#define MAIL_RELEASE_DATE "20231101" +#define MAIL_VERSION_NUMBER "3.8.3" #ifdef SNAPSHOT #define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE diff --git a/postfix/src/local/local_expand.c b/postfix/src/local/local_expand.c index af2de45e1..ff9c3d6ff 100644 --- a/postfix/src/local/local_expand.c +++ b/postfix/src/local/local_expand.c @@ -138,6 +138,8 @@ static const char *local_expand_lookup(const char *name, int mode, void *ptr) } else if (STREQ(name, "recipient_delimiter")) { rcpt_delim[0] = local->state->msg_attr.local[strlen(local->state->msg_attr.user)]; + if (rcpt_delim[0] == 0) + rcpt_delim[0] = var_rcpt_delim[0]; rcpt_delim[1] = 0; return (rcpt_delim[0] ? rcpt_delim : 0); #if 0 diff --git a/postfix/src/smtpd/smtpd.c b/postfix/src/smtpd/smtpd.c index 16e4d10e3..9f1cc2cef 100644 --- a/postfix/src/smtpd/smtpd.c +++ b/postfix/src/smtpd/smtpd.c @@ -5198,15 +5198,16 @@ static void smtpd_start_tls(SMTPD_STATE *state) if (requirecert && TLS_CERT_IS_TRUSTED(state->tls_context) == 0) { /* - * Fetch and reject the next command (should be EHLO), then - * disconnect (side-effect of returning "421 ...". + * In non-wrappermode, fetch the next command (should be EHLO). Reply + * with 421, then disconnect (as a side-effect of replying with 421). */ cert_present = TLS_CERT_IS_PRESENT(state->tls_context); msg_info("NOQUEUE: abort: TLS from %s: %s", state->namaddr, cert_present ? "Client certificate not trusted" : "No client certificate presented"); - smtpd_chat_query(state); + if (var_smtpd_tls_wrappermode == 0) + smtpd_chat_query(state); smtpd_chat_reply(state, "421 4.7.1 %s Error: %s", var_myhostname, cert_present ? "Client certificate not trusted" : diff --git a/postfix/src/smtpd/smtpd_sasl_glue.c b/postfix/src/smtpd/smtpd_sasl_glue.c index 2c5271916..2dc6aad31 100644 --- a/postfix/src/smtpd/smtpd_sasl_glue.c +++ b/postfix/src/smtpd/smtpd_sasl_glue.c @@ -340,9 +340,11 @@ int smtpd_sasl_authenticate(SMTPD_STATE *state, } } if (status != XSASL_AUTH_DONE) { - msg_warn("%s: SASL %s authentication failed: %s", - state->namaddr, sasl_method, - STR(state->sasl_reply)); + sasl_username = xsasl_server_get_username(state->sasl_server); + msg_warn("%s: SASL %.100s authentication failed: %s, sasl_username=%.100s", + state->namaddr, sasl_method, *STR(state->sasl_reply) ? + STR(state->sasl_reply) : "(reason unavailable)", + sasl_username ? sasl_username : "(unavailable)"); /* RFC 4954 Section 6. */ if (status == XSASL_AUTH_TEMP) smtpd_chat_reply(state, "454 4.7.0 Temporary authentication failure: %s", diff --git a/postfix/src/xsasl/xsasl_cyrus_server.c b/postfix/src/xsasl/xsasl_cyrus_server.c index 89e1fc9a0..4bf2ed212 100644 --- a/postfix/src/xsasl/xsasl_cyrus_server.c +++ b/postfix/src/xsasl/xsasl_cyrus_server.c @@ -625,16 +625,15 @@ static const char *xsasl_cyrus_server_get_username(XSASL_SERVER *xp) /* * XXX Do not free(serverout). */ - sasl_status = sasl_getprop(server->sasl_conn, SASL_USERNAME, &serverout); - if (sasl_status != SASL_OK || serverout == 0) { - msg_warn("%s: sasl_getprop SASL_USERNAME botch: %s", - myname, xsasl_cyrus_strerror(sasl_status)); - return (0); - } if (server->username) myfree(server->username); - server->username = mystrdup(serverout); - printable(server->username, '?'); + sasl_status = sasl_getprop(server->sasl_conn, SASL_USERNAME, &serverout); + if (sasl_status != SASL_OK || serverout == 0) { + server->username = 0; + } else { + server->username = mystrdup(serverout); + printable(server->username, '?'); + } return (server->username); }