diff --git a/postfix/HISTORY b/postfix/HISTORY index a6c374f94..fd45ffe07 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -15799,8 +15799,8 @@ Apologies for any names omitted. tls/tls_dh.c, tls/tls_server.c. Portability: Mac OS 10.6.3 requires - instead of . Files: makedefs, - util/sys_defs.h, dns/dns.h. + instead of . Files: makedefs, util/sys_defs.h, + dns/dns.h. 20100531 @@ -15820,3 +15820,14 @@ Apologies for any names omitted. Portability: Berkeley DB 5.x has the same API as Berkeley DB 4.1 and later. File: util/dict_db.c. + +20100610 + + Postfix no longer appends the system default CAs to the + lists specified with *_tls_CAfile or with *_tls_CApath. + This prevents third-party certificates from being trusted + and being given mail relay permission with + permit_tls_all_clientcerts. To get the old behavior specify + "tls_append_default_CA = yes". Files: tls/tls_certkey.c, + tls/tls_misc.c, global/mail_params.h. proto/postconf.proto, + mantools/postlink. diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index b9715478f..b0c82af36 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -14,6 +14,16 @@ specifies the release date of a stable release or snapshot release. If you upgrade from Postfix 2.6 or earlier, read RELEASE_NOTES-2.7 before proceeding. +Incompatibility with snapshot 20100610 +====================================== + +Postfix no longer appends the system-supplied default CAs to the +lists specified with *_tls_CAfile or with *_tls_CApath. This prevents +third-party certificates from being trusted and being given mail +relay permission with permit_tls_all_clientcerts. + +Specify "tls_append_default_CA = yes" for the old behavior. + Incompatibility with snapshot 20100101 ====================================== diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html index 4f897f9f8..365fed132 100644 --- a/postfix/html/postconf.5.html +++ b/postfix/html/postconf.5.html @@ -6202,7 +6202,8 @@ Examples:

The internet domain name of this mail system. The default is to -use $myhostname minus the first component. $mydomain is used as +use $myhostname minus the first component, or "localdomain" (Postfix +2.3 and later). $mydomain is used as a default value for many other configuration parameters.

@@ -6222,9 +6223,10 @@ Example:

The internet hostname of this mail system. The default is to use -the fully-qualified domain name from gethostname(). $myhostname is -used as a default value for many other configuration parameters. -

+the fully-qualified domain name (FQDN) from gethostname(), or to +use the non-FQDN result from gethostname() and append ".$mydomain". +$myhostname is used as a default value for many other configuration +parameters.

Example: @@ -9457,6 +9459,10 @@ file may also be used to augment the client certificate trust chain, but it is best to include all the required certificates directly in $smtp_tls_cert_file.

+

Specify "tls_append_default_CA = no" to prevent Postfix from +appending the system-supplied default CAs and trusting third-party +certificates. This setting is default as of Postfix 2.8.

+

Example: 

@@ -9480,6 +9486,10 @@ with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs".
 
 To use this option in chroot mode, this directory (or a copy)
 must be inside the chroot jail. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. This setting is default as of Postfix 2.8. 

+
 
 Example: 

 
 
@@ -11131,8 +11141,10 @@ authenticated via the RFC 4954
 
 Permit the request when the remote SMTP client certificate is
 verified successfully.  This option must be used only if a special
 CA issues the certificates and only this CA is listed as trusted
-CA, otherwise all clients with a recognized certificate would be
-allowed to relay. This feature is available with Postfix version 2.2.

+CA. This requires that "tls_append_default_CA = no" (the default
+with Postfix 2.8 and later).  Otherwise, clients with a third-party
+certificate would also be allowed to relay. This feature is available
+with Postfix version 2.2.
 
 
permit_tls_clientcerts

 
@@ -12945,6 +12957,10 @@ file may also be used to augment the server certificate trust chain,
 but it is best to include all the required certificates directly in the
 server certificate file. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. This setting is default as of Postfix 2.8. 

+
 
 By default (see smtpd_tls_ask_ccert), client certificates are not
 requested, and smtpd_tls_CAfile should remain empty. If you do make use
 of client certificates, the distinguished names (DNs) of the certificate
@@ -12976,6 +12992,10 @@ for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". To use
 smtpd_tls_CApath in chroot mode, this directory (or a copy) must be
 inside the chroot jail. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. This setting is default as of Postfix 2.8. 

+
 
 By default (see smtpd_tls_ask_ccert), client certificates are
 not requested, and smtpd_tls_CApath should remain empty. In contrast
 to smtpd_tls_CAfile, DNs of certificate authorities installed
@@ -14087,6 +14107,23 @@ connections.  Next, you enable Postfix TCP servers with the updated
 
 This feature is available in Postfix 2.6 and later. 

 
 
+
+
+
tls_append_default_CA
+(default: no)

+
+
 Append the system-supplied default certificate authority
+certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
+

+
+
 To avoid massive compatibility breaks, this parameter defaults
+to "yes" for Postfix versions 2.7 and earlier. That is, they trust
+third-party certificates and they give relay permission with
+permit_tls_all_clientcerts.  

+
+
 This feature is retroactive in Postfix 2.4 and later. 

+
+
 

 
 
tls_daemon_random_bytes
diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5
index c575488d8..592ecfa47 100644
--- a/postfix/man/man5/postconf.5
+++ b/postfix/man/man5/postconf.5
@@ -3473,7 +3473,8 @@ mydestination = $myhostname, localhost.$mydomain www.$mydomain, ftp.$mydomain
 .ft R
 .SH mydomain (default: see "postconf -d" output)
 The internet domain name of this mail system.  The default is to
-use $myhostname minus the first component.  $mydomain is used as
+use $myhostname minus the first component, or "localdomain" (Postfix
+2.3 and later).  $mydomain is used as
 a default value for many other configuration parameters.
 .PP
 Example:
@@ -3487,8 +3488,10 @@ mydomain = domain.tld
 .ft R
 .SH myhostname (default: see "postconf -d" output)
 The internet hostname of this mail system. The default is to use
-the fully-qualified domain name from gethostname(). $myhostname is
-used as a default value for many other configuration parameters.
+the fully-qualified domain name (FQDN) from gethostname(), or to
+use the non-FQDN result from gethostname() and append ".$mydomain".
+$myhostname is used as a default value for many other configuration
+parameters.
 .PP
 Example:
 .PP
@@ -5409,6 +5412,10 @@ file may also be used to augment the client certificate trust chain,
 but it is best to include all the required certificates directly in
 $smtp_tls_cert_file.
 .PP
+Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. This setting is default as of Postfix 2.8.
+.PP
 Example:
 .PP
 .nf
@@ -5429,6 +5436,10 @@ with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs".
 To use this option in chroot mode, this directory (or a copy)
 must be inside the chroot jail.
 .PP
+Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. This setting is default as of Postfix 2.8.
+.PP
 Example:
 .PP
 .nf
@@ -6792,8 +6803,10 @@ authenticated via the RFC 4954 (AUTH) protocol.
 Permit the request when the remote SMTP client certificate is
 verified successfully.  This option must be used only if a special
 CA issues the certificates and only this CA is listed as trusted
-CA, otherwise all clients with a recognized certificate would be
-allowed to relay. This feature is available with Postfix version 2.2.
+CA. This requires that "tls_append_default_CA = no" (the default
+with Postfix 2.8 and later).  Otherwise, clients with a third-party
+certificate would also be allowed to relay. This feature is available
+with Postfix version 2.2.
 .IP "\fBpermit_tls_clientcerts\fR"
 Permit the request when the remote SMTP client certificate
 fingerprint is listed in $relay_clientcerts.
@@ -8036,6 +8049,10 @@ file may also be used to augment the server certificate trust chain,
 but it is best to include all the required certificates directly in the
 server certificate file.
 .PP
+Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. This setting is default as of Postfix 2.8.
+.PP
 By default (see smtpd_tls_ask_ccert), client certificates are not
 requested, and smtpd_tls_CAfile should remain empty. If you do make use
 of client certificates, the distinguished names (DNs) of the certificate
@@ -8065,6 +8082,10 @@ for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". To use
 smtpd_tls_CApath in chroot mode, this directory (or a copy) must be
 inside the chroot jail.
 .PP
+Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. This setting is default as of Postfix 2.8.
+.PP
 By default (see smtpd_tls_ask_ccert), client certificates are
 not requested, and smtpd_tls_CApath should remain empty. In contrast
 to smtpd_tls_CAfile, DNs of certificate authorities installed
@@ -8919,6 +8940,16 @@ tcp_windowsize change will work only for Postfix TCP clients (\fBsmtp\fR(8),
 \fBlmtp\fR(8)).
 .PP
 This feature is available in Postfix 2.6 and later.
+.SH tls_append_default_CA (default: no)
+Append the system-supplied default certificate authority
+certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
+.PP
+To avoid massive compatibility breaks, this parameter defaults
+to "yes" for Postfix versions 2.7 and earlier. That is, they trust
+third-party certificates and they give relay permission with
+permit_tls_all_clientcerts.
+.PP
+This feature is retroactive in Postfix 2.4 and later.
 .SH tls_daemon_random_bytes (default: 32)
 The number of pseudo-random bytes that an \fBsmtp\fR(8) or \fBsmtpd\fR(8)
 process requests from the \fBtlsmgr\fR(8) server in order to seed its
diff --git a/postfix/mantools/postlink b/postfix/mantools/postlink
index a18537b77..f7ba92184 100755
--- a/postfix/mantools/postlink
+++ b/postfix/mantools/postlink
@@ -677,6 +677,7 @@ while (<>) {
     s;\btls_null_cipherlist\b;$&;g;
     s;\btls_eecdh_strong_curve\b;$&;g;
     s;\btls_eecdh_ultra_curve\b;$&;g;
+    s;\btls_append_default_CA\b;$&;g;
  
     s;\bfrozen_delivered_to\b;$&;g;
 
diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto
index c4a5f4595..574ee1ebd 100644
--- a/postfix/proto/postconf.proto
+++ b/postfix/proto/postconf.proto
@@ -2884,7 +2884,8 @@ mydestination = $myhostname, localhost.$mydomain www.$mydomain, ftp.$mydomain
 
 

 The internet domain name of this mail system.  The default is to
-use $myhostname minus the first component.  $mydomain is used as
+use $myhostname minus the first component, or "localdomain" (Postfix
+2.3 and later).  $mydomain is used as
 a default value for many other configuration parameters.
 

 
@@ -2900,9 +2901,10 @@ mydomain = domain.tld
 
 

 The internet hostname of this mail system. The default is to use
-the fully-qualified domain name from gethostname(). $myhostname is
-used as a default value for many other configuration parameters.
-

+the fully-qualified domain name (FQDN) from gethostname(), or to
+use the non-FQDN result from gethostname() and append ".$mydomain".
+$myhostname is used as a default value for many other configuration
+parameters.  

 
 

 Example:
@@ -4858,8 +4860,10 @@ authenticated via the RFC 4954 (AUTH) protocol. 
 
 Permit the request when the remote SMTP client certificate is
 verified successfully.  This option must be used only if a special
 CA issues the certificates and only this CA is listed as trusted
-CA, otherwise all clients with a recognized certificate would be
-allowed to relay. This feature is available with Postfix version 2.2.

+CA. This requires that "tls_append_default_CA = no" (the default
+with Postfix 2.8 and later).  Otherwise, clients with a third-party
+certificate would also be allowed to relay. This feature is available
+with Postfix version 2.2.
 
 
permit_tls_clientcerts

 
@@ -8672,6 +8676,10 @@ file may also be used to augment the server certificate trust chain,
 but it is best to include all the required certificates directly in the
 server certificate file. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. This setting is default as of Postfix 2.8. 

+
 
 By default (see smtpd_tls_ask_ccert), client certificates are not
 requested, and smtpd_tls_CAfile should remain empty. If you do make use
 of client certificates, the distinguished names (DNs) of the certificate
@@ -8699,6 +8707,10 @@ for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". To use
 smtpd_tls_CApath in chroot mode, this directory (or a copy) must be
 inside the chroot jail. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. This setting is default as of Postfix 2.8. 

+
 
 By default (see smtpd_tls_ask_ccert), client certificates are
 not requested, and smtpd_tls_CApath should remain empty. In contrast
 to smtpd_tls_CAfile, DNs of certificate authorities installed
@@ -9067,6 +9079,10 @@ file may also be used to augment the client certificate trust chain,
 but it is best to include all the required certificates directly in
 $smtp_tls_cert_file. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. This setting is default as of Postfix 2.8. 

+
 
 Example: 

 
 
@@ -9086,6 +9102,10 @@ with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs".
 
 To use this option in chroot mode, this directory (or a copy) 
 must be inside the chroot jail. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. This setting is default as of Postfix 2.8. 

+
 
 Example: 

 
 
@@ -9375,6 +9395,19 @@ smtp_tls_dcert_file = /etc/postfix/client-dsa.pem
 
 
 This feature is available in Postfix 2.2 and later.  

 
+%PARAM tls_append_default_CA no
+
+
 Append the system-supplied default certificate authority
+certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
+

+
+
 To avoid massive compatibility breaks, this parameter defaults
+to "yes" for Postfix versions 2.7 and earlier. That is, they trust
+third-party certificates and they give relay permission with
+permit_tls_all_clientcerts.  

+
+
 This feature is retroactive in Postfix 2.4 and later. 

+
 %PARAM tls_random_exchange_name see "postconf -d" output
 
 
 Name of the pseudo random number generator (PRNG) state file
diff --git a/postfix/src/global/mail_params.h b/postfix/src/global/mail_params.h
index 8861b8245..1d4be1e99 100644
--- a/postfix/src/global/mail_params.h
+++ b/postfix/src/global/mail_params.h
@@ -623,6 +623,10 @@ extern bool var_stat_home_dir;
 #define DEF_DUP_FILTER_LIMIT	1000
 extern int var_dup_filter_limit;
 
+#define VAR_TLS_APPEND_DEF_CA	"tls_append_default_CA"
+#define DEF_TLS_APPEND_DEF_CA	0	/* 1 for Postfix < 2.8 */
+extern bool var_tls_append_def_CA;
+
 #define VAR_TLS_RAND_EXCH_NAME	"tls_random_exchange_name"
 #define DEF_TLS_RAND_EXCH_NAME	"${data_directory}/prng_exch"
 extern char *var_tls_rand_exch_name;
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index e621dd140..f2bfc7139 100644
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,7 +20,7 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20100603"
+#define MAIL_RELEASE_DATE	"20100610"
 #define MAIL_VERSION_NUMBER	"2.8"
 
 #ifdef SNAPSHOT
diff --git a/postfix/src/tls/Makefile.in b/postfix/src/tls/Makefile.in
index 1a8e26da7..918a9732f 100644
--- a/postfix/src/tls/Makefile.in
+++ b/postfix/src/tls/Makefile.in
@@ -101,6 +101,7 @@ tls_bio_ops.o: ../../include/vstring.h
 tls_bio_ops.o: tls.h
 tls_bio_ops.o: tls_bio_ops.c
 tls_certkey.o: ../../include/argv.h
+tls_certkey.o: ../../include/mail_params.h
 tls_certkey.o: ../../include/msg.h
 tls_certkey.o: ../../include/name_code.h
 tls_certkey.o: ../../include/name_mask.h
diff --git a/postfix/src/tls/tls_certkey.c b/postfix/src/tls/tls_certkey.c
index 913b67e23..504c18627 100644
--- a/postfix/src/tls/tls_certkey.c
+++ b/postfix/src/tls/tls_certkey.c
@@ -70,6 +70,10 @@
 
 #include 
 
+/* Global library. */
+
+#include 
+
 /* TLS library. */
 
 #define TLS_INTERNAL
@@ -91,7 +95,7 @@ int     tls_set_ca_certificate_info(SSL_CTX *ctx, const char *CAfile,
 	    tls_print_errors();
 	    return (-1);
 	}
-	if (!SSL_CTX_set_default_verify_paths(ctx)) {
+	if (var_tls_append_def_CA && !SSL_CTX_set_default_verify_paths(ctx)) {
 	    msg_info("cannot set certificate verification paths: "
 		     "disabling TLS support");
 	    tls_print_errors();
diff --git a/postfix/src/tls/tls_misc.c b/postfix/src/tls/tls_misc.c
index 8f12fe166..c1fd1c52a 100644
--- a/postfix/src/tls/tls_misc.c
+++ b/postfix/src/tls/tls_misc.c
@@ -15,6 +15,7 @@
 /*	char	*var_tls_eecdh_strong;
 /*	char	*var_tls_eecdh_ultra;
 /*	int	var_tls_daemon_rand_bytes;
+/*	bool    var_tls_append_def_CA;
 /*
 /*	TLS_APPL_STATE *tls_alloc_app_context(ssl_ctx)
 /*	SSL_CTX	*ssl_ctx;
@@ -190,6 +191,7 @@ char   *var_tls_null_clist;
 int     var_tls_daemon_rand_bytes;
 char   *var_tls_eecdh_strong;
 char   *var_tls_eecdh_ultra;
+bool    var_tls_append_def_CA;
 
  /*
   * Index to attach TLScontext pointers to SSL objects, so that they can be
@@ -407,6 +409,10 @@ void    tls_param_init(void)
 	VAR_TLS_DAEMON_RAND_BYTES, DEF_TLS_DAEMON_RAND_BYTES, &var_tls_daemon_rand_bytes, 1, 0,
 	0,
     };
+    static const CONFIG_BOOL_TABLE bool_table[] = {
+	VAR_TLS_APPEND_DEF_CA, DEF_TLS_APPEND_DEF_CA, &var_tls_append_def_CA,
+	0,
+    };
     static int init_done;
 
     if (init_done)