mir/postfix
2
0
Fork 0
mirror of https://github.com/vdukhovni/postfix synced 2025-08-30 05:38:06 +00:00
Code Issues Releases Wiki Activity

postfix-3.5.6

Browse Source
This commit is contained in:
Wietse Venema 2020-07-26 00:00:00 -05:00 committed by Viktor Dukhovni
parent 520ad2ab5c
commit c09655462b
4 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
postfix/HISTORY
View File

@ -24809,3 +24809,13 @@ Apologies for any names omitted.
settings in a system-wide OpenSSL configuration file, causing settings in a system-wide OpenSSL configuration file, causing
interoperability problems after an OS update. File: interoperability problems after an OS update. File:
tls/tls_client.c, tls/tls_server.c. tls/tls_client.c, tls/tls_server.c.
20200726
Bugfix (introduced: Postfix 3.5.5): part of a memory leak
fix was backported to the wrong place. File: tls/tls_misc.c.
The Postfix 3.5.5 workaround did not explicitly override
the system-wide OpenSSL configuration of allowed TLS protocol
versions, for sessions where the remote SMTP client sends
SNI. It's better to be safe than sorry. File: tls/tls_server.c.

4
postfix/src/global/mail_version.h
View File

@ -20,8 +20,8 @@
* Patches change both the patchlevel and the release date. Snapshots have no * Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only. * patchlevel; they change the release date only.
*/ */
#define MAIL_RELEASE_DATE "20200724" #define MAIL_RELEASE_DATE "20200726"
#define MAIL_VERSION_NUMBER "3.5.5" #define MAIL_VERSION_NUMBER "3.5.6"
#ifdef SNAPSHOT #ifdef SNAPSHOT
#define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE #define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE

4
postfix/src/tls/tls_misc.c
View File

@ -922,8 +922,6 @@ void tls_get_signature_params(TLS_SESS_STATE *TLScontext)
*/ */
if (SSL_get_signature_nid(ssl, &nid) && nid != NID_undef) if (SSL_get_signature_nid(ssl, &nid) && nid != NID_undef)
locl_sig_dgst = OBJ_nid2sn(nid); locl_sig_dgst = OBJ_nid2sn(nid);
X509_free(cert);
} }
/* Signature algorithms for the peer end of the connection */ /* Signature algorithms for the peer end of the connection */
if ((cert = SSL_get_peer_certificate(ssl)) != 0) { if ((cert = SSL_get_peer_certificate(ssl)) != 0) {
@ -965,6 +963,8 @@ void tls_get_signature_params(TLS_SESS_STATE *TLScontext)
*/ */
if (SSL_get_peer_signature_nid(ssl, &nid) && nid != NID_undef) if (SSL_get_peer_signature_nid(ssl, &nid) && nid != NID_undef)
peer_sig_dgst = OBJ_nid2sn(nid); peer_sig_dgst = OBJ_nid2sn(nid);
X509_free(cert);
} }
if (kex_name) { if (kex_name) {
TLScontext->kex_name = mystrdup(kex_name); TLScontext->kex_name = mystrdup(kex_name);

1
postfix/src/tls/tls_server.c
View File

@ -530,6 +530,7 @@ TLS_APPL_STATE *tls_server_init(const TLS_SERVER_INIT_PROPS *props)
/* Enable all supported protocols */ /* Enable all supported protocols */
#if OPENSSL_VERSION_NUMBER >= 0x1010000fUL #if OPENSSL_VERSION_NUMBER >= 0x1010000fUL
SSL_CTX_set_min_proto_version(server_ctx, 0); SSL_CTX_set_min_proto_version(server_ctx, 0);
SSL_CTX_set_min_proto_version(sni_ctx, 0);
#endif #endif
/* /*