mir/postfix
2
0
Fork 0
mirror of https://github.com/vdukhovni/postfix synced 2025-09-04 08:05:37 +00:00
Code Issues Releases Wiki Activity

postfix-2.8.17

Browse Source
This commit is contained in:
Wietse Venema
2014-01-16 00:00:00 -05:00
committed by Viktor Dukhovni
parent 56213cadf6
commit 658d27efe5
12 changed files with 106 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
postfix/HISTORY
View File

@@ -16938,3 +16938,36 @@ Apologies for any names omitted.
each smtpd(8) process. The workaround turns off session each smtpd(8) process. The workaround turns off session
tickets. In 2.11 we'll enable session tickets properly. tickets. In 2.11 we'll enable session tickets properly.
Viktor Dukhovni. File: tls/tls_server.c. Viktor Dukhovni. File: tls/tls_server.c.
20131026
Future proofing: API changes in the PCRE library. File:
util/dict_pcre.c.
20131127
Bugfix (introduced: 20090106): the postconf '-#' option
erased prior options. File: postconf/postconf.c.
20131129
Bugfix: Makefile example in MULTI_INSTANCE_README. Viktor
Dukhovni. File: proto/MULTI_INSTANCE_README.html.
20131216
OpenSSL future proofing: tolerate disappearance of named
bug-workaround bits without invalidating tls_disable_workarounds
configurations. When support for a bug workaround is removed
from OpenSSL, the corresponding bit is defined as zero (i.e.
NOOP) instead of causing programs to break. Viktor Dukhovni.
File: tls/tls_misc.c.
20131220
Documentation: typo in SASL_README. Patrick Ben Koetter.
File: proto/SASL_README.html.
20140104
Bugfix: malformed error message. File: conf/post-install.

6
postfix/README_FILES/MULTI_INSTANCE_README
View File

@@ -177,7 +177,7 @@ database when none exists.
generic: Makefile generic: Makefile
@echo Creating $@ @echo Creating $@
@rm -f $@.tmp @rm -f $@.tmp
@printf '%s\t%s+root=%s\n' root $MTAADMIN `uname -n` > $@.tmp @printf '%s\t%s+root=%s\n' root ${MTAADMIN} `uname -n` > $@.tmp
@mv $@.tmp generic @mv $@.tmp generic
%.cdb: % %.cdb: %
@@ -492,8 +492,8 @@ Shared among all instances:
$readme_directory. $readme_directory.
* Entries in /etc/passwd and /etc/group for the $mail_owner user and * Entries in /etc/passwd and /etc/group for the $mail_owner user and
$setgid_group group. The the $mail_owner user provides the mail system with $setgid_group group. The $mail_owner user provides the mail system with a
a protected (non-root) execution context. The $setgid_group group is used protected (non-root) execution context. The $setgid_group group is used
exclusively to support the setgid postdrop(1) and postqueue(1) utilities exclusively to support the setgid postdrop(1) and postqueue(1) utilities
(it mmuusstt nnoott be the primary group or secondary group of any users, (it mmuusstt nnoott be the primary group or secondary group of any users,
including the $mail_owner user). including the $mail_owner user).

2
postfix/README_FILES/SASL_README
View File

@@ -444,7 +444,7 @@ to a PostgreSQL server:
sql_user: username sql_user: username
sql_passwd: secret sql_passwd: secret
sql_database: dbname sql_database: dbname
sql_select: SELECT password FROM users WHERE user = '%u'@'%r' sql_select: SELECT password FROM users WHERE user = '%u@%r'
NNoottee NNoottee

2
postfix/conf/post-install
View File

@@ -464,7 +464,7 @@ test -n "$create" && {
case $type in case $type in
[hl]) continue;; [hl]) continue;;
[df]) ;; [df]) ;;
*) echo unknown type $type for $path in $daemon_directory/postfix-files1>&2; exit 1;; *) echo unknown type $type for $path in $daemon_directory/postfix-files 1>&2; exit 1;;
esac esac
# Expand $name, and canonicalize null fields. # Expand $name, and canonicalize null fields.
for name in path owner group flags for name in path owner group flags

4
postfix/html/MULTI_INSTANCE_README.html
View File

@@ -233,7 +233,7 @@ creates a "generic" database when none exists. </p>
generic: Makefile generic: Makefile
@echo Creating $@ @echo Creating $@
@rm -f $@.tmp @rm -f $@.tmp
@printf '%s\t%s+root=%s\n' root $MTAADMIN `uname -n` &gt; $@.tmp @printf '%s\t%s+root=%s\n' root ${MTAADMIN} `uname -n` &gt; $@.tmp
@mv $@.tmp generic @mv $@.tmp generic
%.<a href="CDB_README.html">cdb</a>: % %.<a href="CDB_README.html">cdb</a>: %
@@ -620,7 +620,7 @@ $<a href="postconf.5.html#daemon_directory">daemon_directory</a>. </p>
$<a href="postconf.5.html#manpage_directory">manpage_directory</a> and $<a href="postconf.5.html#readme_directory">readme_directory</a>. </p> $<a href="postconf.5.html#manpage_directory">manpage_directory</a> and $<a href="postconf.5.html#readme_directory">readme_directory</a>. </p>
<li><p> Entries in /etc/passwd and /etc/group for the $<a href="postconf.5.html#mail_owner">mail_owner</a> user and <li><p> Entries in /etc/passwd and /etc/group for the $<a href="postconf.5.html#mail_owner">mail_owner</a> user and
$<a href="postconf.5.html#setgid_group">setgid_group</a> group. The the $<a href="postconf.5.html#mail_owner">mail_owner</a> user provides the mail system $<a href="postconf.5.html#setgid_group">setgid_group</a> group. The $<a href="postconf.5.html#mail_owner">mail_owner</a> user provides the mail system
with a protected (non-root) execution context. The $<a href="postconf.5.html#setgid_group">setgid_group</a> group with a protected (non-root) execution context. The $<a href="postconf.5.html#setgid_group">setgid_group</a> group
is used exclusively to support the setgid <a href="postdrop.1.html">postdrop(1)</a> and <a href="postqueue.1.html">postqueue(1)</a> is used exclusively to support the setgid <a href="postdrop.1.html">postdrop(1)</a> and <a href="postqueue.1.html">postqueue(1)</a>
utilities (it <b>must not</b> be the primary group or secondary group utilities (it <b>must not</b> be the primary group or secondary group

2
postfix/html/SASL_README.html
View File

@@ -739,7 +739,7 @@ and connects it to a PostgreSQL server: </p>
sql_user: username sql_user: username
sql_passwd: secret sql_passwd: secret
sql_database: dbname sql_database: dbname
sql_select: SELECT password FROM users WHERE user = '%u'@'%r' sql_select: SELECT password FROM users WHERE user = '%u@%r'
</pre> </pre>
</blockquote> </blockquote>

4
postfix/proto/MULTI_INSTANCE_README.html
View File

@@ -233,7 +233,7 @@ creates a "generic" database when none exists. </p>
generic: Makefile generic: Makefile
@echo Creating $@ @echo Creating $@
@rm -f $@.tmp @rm -f $@.tmp
@printf '%s\t%s+root=%s\n' root $MTAADMIN `uname -n` &gt; $@.tmp @printf '%s\t%s+root=%s\n' root ${MTAADMIN} `uname -n` &gt; $@.tmp
@mv $@.tmp generic @mv $@.tmp generic
%.cdb: % %.cdb: %
@@ -620,7 +620,7 @@ $daemon_directory. </p>
$manpage_directory and $readme_directory. </p> $manpage_directory and $readme_directory. </p>
<li><p> Entries in /etc/passwd and /etc/group for the $mail_owner user and <li><p> Entries in /etc/passwd and /etc/group for the $mail_owner user and
$setgid_group group. The the $mail_owner user provides the mail system $setgid_group group. The $mail_owner user provides the mail system
with a protected (non-root) execution context. The $setgid_group group with a protected (non-root) execution context. The $setgid_group group
is used exclusively to support the setgid postdrop(1) and postqueue(1) is used exclusively to support the setgid postdrop(1) and postqueue(1)
utilities (it <b>must not</b> be the primary group or secondary group utilities (it <b>must not</b> be the primary group or secondary group

2
postfix/proto/SASL_README.html
View File

@@ -739,7 +739,7 @@ and connects it to a PostgreSQL server: </p>
sql_user: username sql_user: username
sql_passwd: secret sql_passwd: secret
sql_database: dbname sql_database: dbname
sql_select: SELECT password FROM users WHERE user = '%u'@'%r' sql_select: SELECT password FROM users WHERE user = '%u@%r'
</pre> </pre>
</blockquote> </blockquote>

4
postfix/src/global/mail_version.h
View File

@@ -20,8 +20,8 @@
* Patches change both the patchlevel and the release date. Snapshots have no * Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only. * patchlevel; they change the release date only.
*/ */
#define MAIL_RELEASE_DATE "20130905" #define MAIL_RELEASE_DATE "20140116"
#define MAIL_VERSION_NUMBER "2.8.16" #define MAIL_VERSION_NUMBER "2.8.17"
#ifdef SNAPSHOT #ifdef SNAPSHOT
# define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE # define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE

2
postfix/src/postconf/postconf.c
View File

@@ -1157,7 +1157,7 @@ int main(int argc, char **argv)
break; break;
#endif #endif
case '#': case '#':
cmd_mode = COMMENT_OUT; cmd_mode |= COMMENT_OUT;
break; break;
case 'h': case 'h':

76
postfix/src/tls/tls_misc.c
View File

@@ -230,59 +230,72 @@ static const NAME_CODE protocol_table[] = {
#define NAMEBUG(x) #x, SSL_OP_##x #define NAMEBUG(x) #x, SSL_OP_##x
static const LONG_NAME_MASK ssl_bug_tweaks[] = { static const LONG_NAME_MASK ssl_bug_tweaks[] = {
#if defined(SSL_OP_MICROSOFT_SESS_ID_BUG) #ifndef SSL_OP_MICROSOFT_SESS_ID_BUG
NAMEBUG(MICROSOFT_SESS_ID_BUG), /* 0x00000001L */ #define SSL_OP_MICROSOFT_SESS_ID_BUG 0
#endif #endif
NAMEBUG(MICROSOFT_SESS_ID_BUG),
#if defined(SSL_OP_NETSCAPE_CHALLENGE_BUG) #ifndef SSL_OP_NETSCAPE_CHALLENGE_BUG
NAMEBUG(NETSCAPE_CHALLENGE_BUG), /* 0x00000002L */ #define SSL_OP_NETSCAPE_CHALLENGE_BUG 0
#endif #endif
NAMEBUG(NETSCAPE_CHALLENGE_BUG),
#if defined(SSL_OP_LEGACY_SERVER_CONNECT) #ifndef SSL_OP_LEGACY_SERVER_CONNECT
NAMEBUG(LEGACY_SERVER_CONNECT), /* 0x00000004L */ #define SSL_OP_LEGACY_SERVER_CONNECT 0
#endif #endif
NAMEBUG(LEGACY_SERVER_CONNECT),
#if defined(SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) #ifndef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
NAMEBUG(NETSCAPE_REUSE_CIPHER_CHANGE_BUG), /* 0x00000008L */ #define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG 0
#endif
NAMEBUG(NETSCAPE_REUSE_CIPHER_CHANGE_BUG),
"CVE-2010-4180", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG, "CVE-2010-4180", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG,
#endif
#if defined(SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG) #ifndef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
NAMEBUG(SSLREF2_REUSE_CERT_TYPE_BUG), /* 0x00000010L */ #define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG 0
#endif #endif
NAMEBUG(SSLREF2_REUSE_CERT_TYPE_BUG),
#if defined(SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER) #ifndef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
NAMEBUG(MICROSOFT_BIG_SSLV3_BUFFER),/* 0x00000020L */ #define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER 0
#endif #endif
NAMEBUG(MICROSOFT_BIG_SSLV3_BUFFER),
#if defined(SSL_OP_MSIE_SSLV2_RSA_PADDING) #ifndef SSL_OP_MSIE_SSLV2_RSA_PADDING
NAMEBUG(MSIE_SSLV2_RSA_PADDING), /* 0x00000040L */ #define SSL_OP_MSIE_SSLV2_RSA_PADDING 0
#endif
NAMEBUG(MSIE_SSLV2_RSA_PADDING),
"CVE-2005-2969", SSL_OP_MSIE_SSLV2_RSA_PADDING, "CVE-2005-2969", SSL_OP_MSIE_SSLV2_RSA_PADDING,
#endif
#if defined(SSL_OP_SSLEAY_080_CLIENT_DH_BUG) #ifndef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
NAMEBUG(SSLEAY_080_CLIENT_DH_BUG), /* 0x00000080L */ #define SSL_OP_SSLEAY_080_CLIENT_DH_BUG 0
#endif #endif
NAMEBUG(SSLEAY_080_CLIENT_DH_BUG),
#if defined(SSL_OP_TLS_D5_BUG) #ifndef SSL_OP_TLS_D5_BUG
NAMEBUG(TLS_D5_BUG), /* 0x00000100L */ #define SSL_OP_TLS_D5_BUG 0
#endif #endif
NAMEBUG(TLS_D5_BUG),
#if defined(SSL_OP_TLS_BLOCK_PADDING_BUG) #ifndef SSL_OP_TLS_BLOCK_PADDING_BUG
NAMEBUG(TLS_BLOCK_PADDING_BUG), /* 0x00000200L */ #define SSL_OP_TLS_BLOCK_PADDING_BUG 0
#endif #endif
NAMEBUG(TLS_BLOCK_PADDING_BUG),
#if defined(SSL_OP_TLS_ROLLBACK_BUG) #ifndef SSL_OP_TLS_ROLLBACK_BUG
NAMEBUG(TLS_ROLLBACK_BUG), /* 0x00000400L */ #define SSL_OP_TLS_ROLLBACK_BUG 0
#endif #endif
NAMEBUG(TLS_ROLLBACK_BUG),
#if defined(SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) #ifndef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
NAMEBUG(DONT_INSERT_EMPTY_FRAGMENTS), /* 0x00000800L */ #define SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS 0
#endif #endif
NAMEBUG(DONT_INSERT_EMPTY_FRAGMENTS),
#if defined(SSL_OP_CRYPTOPRO_TLSEXT_BUG) #ifndef SSL_OP_CRYPTOPRO_TLSEXT_BUG
NAMEBUG(CRYPTOPRO_TLSEXT_BUG), /* 0x80000000L */ #define SSL_OP_CRYPTOPRO_TLSEXT_BUG 0
#endif #endif
NAMEBUG(CRYPTOPRO_TLSEXT_BUG),
0, 0, 0, 0,
}; };
@@ -802,7 +815,8 @@ long tls_bug_bits(void)
long bits = SSL_OP_ALL; /* Work around all known bugs */ long bits = SSL_OP_ALL; /* Work around all known bugs */
long mask; long mask;
#if OPENSSL_VERSION_NUMBER >= 0x00908000L #if OPENSSL_VERSION_NUMBER >= 0x00908000L && \
OPENSSL_VERSION_NUMBER < 0x10000000L
long lib_version = SSLeay(); long lib_version = SSLeay();
/* /*
@@ -828,6 +842,10 @@ long tls_bug_bits(void)
bits &= ~long_name_mask_opt(VAR_TLS_BUG_TWEAKS, ssl_bug_tweaks, bits &= ~long_name_mask_opt(VAR_TLS_BUG_TWEAKS, ssl_bug_tweaks,
var_tls_bug_tweaks, NAME_MASK_ANY_CASE | var_tls_bug_tweaks, NAME_MASK_ANY_CASE |
NAME_MASK_NUMBER | NAME_MASK_WARN); NAME_MASK_NUMBER | NAME_MASK_WARN);
#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
/* Not relevant to SMTP */
bits &= ~SSL_OP_SAFARI_ECDHE_ECDSA_BUG;
#endif
} }
return (bits); return (bits);
} }

15
postfix/src/util/dict_pcre.c
View File

@@ -59,6 +59,15 @@
#include "mac_parse.h" #include "mac_parse.h"
#include "pcre.h" #include "pcre.h"
/*
* Backwards compatibility.
*/
#ifdef PCRE_STUDY_JIT_COMPILE
#define DICT_PCRE_FREE_STUDY(x) pcre_free_study(x)
#else
#define DICT_PCRE_FREE_STUDY(x) pcre_free((char *) (x))
#endif
/* /*
* Support for IF/ENDIF based on an idea by Bert Driehuis. * Support for IF/ENDIF based on an idea by Bert Driehuis.
*/ */
@@ -387,7 +396,7 @@ static void dict_pcre_close(DICT *dict)
if (match_rule->pattern) if (match_rule->pattern)
myfree((char *) match_rule->pattern); myfree((char *) match_rule->pattern);
if (match_rule->hints) if (match_rule->hints)
myfree((char *) match_rule->hints); DICT_PCRE_FREE_STUDY(match_rule->hints);
if (match_rule->replacement) if (match_rule->replacement)
myfree((char *) match_rule->replacement); myfree((char *) match_rule->replacement);
break; break;
@@ -396,7 +405,7 @@ static void dict_pcre_close(DICT *dict)
if (if_rule->pattern) if (if_rule->pattern)
myfree((char *) if_rule->pattern); myfree((char *) if_rule->pattern);
if (if_rule->hints) if (if_rule->hints)
myfree((char *) if_rule->hints); DICT_PCRE_FREE_STUDY(if_rule->hints);
break; break;
case DICT_PCRE_OP_ENDIF: case DICT_PCRE_OP_ENDIF:
break; break;
@@ -677,7 +686,7 @@ static DICT_PCRE_RULE *dict_pcre_parse_rule(const char *mapname, int lineno,
if (engine.pattern) if (engine.pattern)
myfree((char *) engine.pattern); myfree((char *) engine.pattern);
if (engine.hints) if (engine.hints)
myfree((char *) engine.hints); DICT_PCRE_FREE_STUDY(engine.hints);
CREATE_MATCHOP_ERROR_RETURN(0); CREATE_MATCHOP_ERROR_RETURN(0);
} }
#endif #endif