mir/postfix
2
0
Fork 0
mirror of https://github.com/vdukhovni/postfix synced 2025-09-02 07:05:27 +00:00
Code Issues Releases Wiki Activity

postfix-2.6-20081109

Browse Source
This commit is contained in:
Wietse Venema
2008-11-09 00:00:00 -05:00
committed by Viktor Dukhovni
parent 3720304350
commit 3aba869192
5 changed files with 26 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
postfix/HISTORY
View File

@@ -14753,3 +14753,7 @@ Apologies for any names omitted.
Bugfix (introduced Postfix 2.5): the Postfix SMTP server Bugfix (introduced Postfix 2.5): the Postfix SMTP server
did not ask for a client certificate with "smtpd_tls_req_ccert did not ask for a client certificate with "smtpd_tls_req_ccert
= yes". Reported by Rob Foehl. File: smtpd/smtpd.c. = yes". Reported by Rob Foehl. File: smtpd/smtpd.c.
20081109
Cleanup: confusing names of variables. File: smtpd/smtpd.c.

6
postfix/src/dns/dns.h
View File

@@ -179,11 +179,9 @@ extern int dns_lookup_v(const char *, unsigned, DNS_RR **, VSTRING *,
#define DNS_OK 0 /* query succeeded */ #define DNS_OK 0 /* query succeeded */
/* /*
* How long can a DNS name be? * How long can a DNS name or single text value be?
*
* XXX This currently also limits the combined length of data in TXT records.
*/ */
#define DNS_NAME_LEN 4096 #define DNS_NAME_LEN 1024
/* LICENSE /* LICENSE
/* .ad /* .ad

2
postfix/src/global/mail_version.h
View File

@@ -20,7 +20,7 @@
* Patches change both the patchlevel and the release date. Snapshots have no * Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only. * patchlevel; they change the release date only.
*/ */
#define MAIL_RELEASE_DATE "20081108" #define MAIL_RELEASE_DATE "20081109"
#define MAIL_VERSION_NUMBER "2.6" #define MAIL_VERSION_NUMBER "2.6"
#ifdef SNAPSHOT #ifdef SNAPSHOT

24
postfix/src/smtpd/smtpd.c
View File

@@ -1266,7 +1266,7 @@ MILTERS *smtpd_milters;
* TLS initialization status. * TLS initialization status.
*/ */
static TLS_APPL_STATE *smtpd_tls_ctx; static TLS_APPL_STATE *smtpd_tls_ctx;
static int wantcert; static int require_server_cert;
#endif #endif
@@ -3857,7 +3857,7 @@ static void smtpd_start_tls(SMTPD_STATE *state)
ADD_EXCLUDE(cipher_exclusions, var_smtpd_tls_excl_ciph); ADD_EXCLUDE(cipher_exclusions, var_smtpd_tls_excl_ciph);
if (enforce_tls) if (enforce_tls)
ADD_EXCLUDE(cipher_exclusions, var_smtpd_tls_mand_excl); ADD_EXCLUDE(cipher_exclusions, var_smtpd_tls_mand_excl);
if (wantcert) if (require_server_cert)
ADD_EXCLUDE(cipher_exclusions, "aNULL"); ADD_EXCLUDE(cipher_exclusions, "aNULL");
} }
@@ -4643,8 +4643,9 @@ static void pre_jail_init(char *unused_name, char **unused_argv)
#ifdef USE_TLS #ifdef USE_TLS
TLS_SERVER_INIT_PROPS props; TLS_SERVER_INIT_PROPS props;
const char *cert_file; const char *cert_file;
int havecert; int have_server_cert;
int oknocert; int no_server_cert_ok;
int ask_client_cert;
/* /*
* Can't use anonymous ciphers if we want client certificates. * Can't use anonymous ciphers if we want client certificates.
@@ -4652,25 +4653,26 @@ static void pre_jail_init(char *unused_name, char **unused_argv)
* *
* XXX: Ugh! Too many booleans! * XXX: Ugh! Too many booleans!
*/ */
wantcert = (var_smtpd_tls_ask_ccert ask_client_cert = require_server_cert =
(var_smtpd_tls_ask_ccert
|| (enforce_tls && var_smtpd_tls_req_ccert)); || (enforce_tls && var_smtpd_tls_req_ccert));
if (strcasecmp(var_smtpd_tls_cert_file, "none") == 0) { if (strcasecmp(var_smtpd_tls_cert_file, "none") == 0) {
oknocert = 1; no_server_cert_ok = 1;
cert_file = ""; cert_file = "";
} else { } else {
oknocert = 0; no_server_cert_ok = 0;
cert_file = var_smtpd_tls_cert_file; cert_file = var_smtpd_tls_cert_file;
} }
havecert = have_server_cert =
(*cert_file || *var_smtpd_tls_dcert_file || *var_smtpd_tls_eccert_file); (*cert_file || *var_smtpd_tls_dcert_file || *var_smtpd_tls_eccert_file);
/* Some TLS configuration errors are not show stoppers. */ /* Some TLS configuration errors are not show stoppers. */
if (!havecert && wantcert) if (!have_server_cert && require_server_cert)
msg_warn("Need a server cert to request client certs"); msg_warn("Need a server cert to request client certs");
if (!enforce_tls && var_smtpd_tls_req_ccert) if (!enforce_tls && var_smtpd_tls_req_ccert)
msg_warn("Can't require client certs unless TLS is required"); msg_warn("Can't require client certs unless TLS is required");
/* After a show-stopper error, reply with 454 to STARTTLS. */ /* After a show-stopper error, reply with 454 to STARTTLS. */
if (havecert || (oknocert && !wantcert)) if (have_server_cert || (no_server_cert_ok && !require_server_cert))
/* /*
* Large parameter lists are error-prone, so we emulate a * Large parameter lists are error-prone, so we emulate a
@@ -4701,7 +4703,7 @@ static void pre_jail_init(char *unused_name, char **unused_argv)
protocols = enforce_tls ? protocols = enforce_tls ?
var_smtpd_tls_mand_proto : var_smtpd_tls_mand_proto :
var_smtpd_tls_proto, var_smtpd_tls_proto,
ask_ccert = wantcert, ask_ccert = ask_client_cert,
fpt_dgst = var_smtpd_tls_fpt_dgst); fpt_dgst = var_smtpd_tls_fpt_dgst);
else else
msg_warn("No server certs available. TLS won't be enabled"); msg_warn("No server certs available. TLS won't be enabled");

10
postfix/src/tls/tls_dh.c
View File

@@ -192,13 +192,13 @@ DH *tls_tmp_dh_cb(SSL *unused_ssl, int export, int keylength)
DH *dh_tmp; DH *dh_tmp;
if (export && keylength == 512) { /* 40-bit export cipher */ if (export && keylength == 512) { /* 40-bit export cipher */
if (dh_1024 == 0)
dh_1024 = tls_get_dh(dh512_p, (int) sizeof(dh512_p));
dh_tmp = dh_1024;
} else { /* ADH, DHE-RSA or DSA */
if (dh_512 == 0) if (dh_512 == 0)
dh_512 = tls_get_dh(dh1024_p, (int) sizeof(dh1024_p)); dh_512 = tls_get_dh(dh512_p, (int) sizeof(dh512_p));
dh_tmp = dh_512; dh_tmp = dh_512;
} else { /* ADH, DHE-RSA or DSA */
if (dh_1024 == 0)
dh_1024 = tls_get_dh(dh1024_p, (int) sizeof(dh1024_p));
dh_tmp = dh_1024;
} }
return (dh_tmp); return (dh_tmp);
} }