Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/external/ibm-public/postfix/dist Import Postfix 2.8.11. Chan...
details: https://anonhg.NetBSD.org/src/rev/6fc92ea9802b
branches: trunk
changeset: 779665:6fc92ea9802b
user: tron <tron%NetBSD.org@localhost>
date: Sat Jun 09 11:26:39 2012 +0000
description:
Import Postfix 2.8.11. Changes since version 2.8.8:
- The "change header" milter request could replace the wrong header. A long
header name could match a shorter one, because a length check was done on
the wrong string. Reported by Vladimir Vassiliev.
- Core dump when postlog emitted the "usage" message, caused by an extraneous
null assignment. Reported by Kant (fnord.hammer).
- These releases add support to turn off the TLSv1.1 and TLSv1.2 protocols.
Introduced with OpenSSL version 1.0.1, these protocols are known to cause
inter-operability problems, for example with some hotmail services.
The radical workaround is to temporarily turn off problematic protocols
globally:
/etc/postfix/main.cf:
smtp_tls_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
smtp_tls_mandatory_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
smtpd_tls_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
smtpd_tls_mandatory_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
However, it may be better to temporarily turn off problematic protocols for
broken sites only:
/etc/postfix/main.cf:
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy
/etc/postfix/tls_policy:
example.com may protocols=!SSLv2:!TLSv1.1:!TLSv1.2
Notes:
Note the use of ":" instead of comma or space. Also, note that there is NO
space around the "=" in "protocols=".
The smtp_tls_policy_maps lookup key must match the "next-hop" destination
that is given to the Postfix SMTP client. If you override the next-hop
destination with transport_maps, relayhost, sender_dependent_relayhost_maps,
or otherwise, you need to specify the same destination for the
smtp_tls_policy_maps lookup key.
- OpenSSL related (all supported Postfix versions).
Some people have reported program crashes when the OpenSSL library was
updated while Postfix was accessing the Postfix TLS session cache. To avoid
this, the Postfix TLS session cache ID now includes the OpenSSL library
version number. This cache ID is not shared via the network.
- The OpenSSL workaround introduced with the previous stable and legacy
releases did not compile with older gcc compilers. These compilers can't
handle #ifdef inside a macro invocation (NOT: definition).
- To avoid repeated warnings from postscreen(8) with "connect to
private/dnsblog service: Connection refused" on FreeBSD, the dnsblog(8)
daemon now uses the single_server program driver instead of the multi_server
driver. This one-line code change has no performance impact for other
systems, and eliminates a high-frequency accept() race on a shared socket
that appears to cause trouble on FreeBSD. The same single_server program
driver has proven itself for many years in smtpd(8). Problem reported by
Sahil Tandon.
- Laptop-friendly support (all supported Postfix versions). A little-known
secret is that Postfix has always had support to avoid unnecessary disk
spin-up for MTIME updates, by doing s/fifo/unix/ in master.cf (this is
currently not supported on Solaris systems). However, two minor fixes are
needed to make this bullet-proof.
- In laptop-friendly mode, the "postqueue -f" and "sendmail -q" commands did
not wait until their requests had reached the pickup and qmgr servers before
closing their UNIX-domain request sockets.
- In laptop-friendly mode, the unused postkick command waited for more than
a minute because the event_drain() function was comparing bitmasks
incorrectly on systems with kqueue(2), epoll(2) or /dev/poll support.
diffstat:
external/ibm-public/postfix/dist/HISTORY | 82 ++++++++++
external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES | 37 ++++
external/ibm-public/postfix/dist/RELEASE_NOTES | 37 ++++
external/ibm-public/postfix/dist/html/lmtp.8.html | 2 +-
external/ibm-public/postfix/dist/html/smtp.8.html | 2 +-
external/ibm-public/postfix/dist/html/smtpd.8.html | 2 +-
external/ibm-public/postfix/dist/man/man8/smtp.8 | 4 +-
external/ibm-public/postfix/dist/man/man8/smtpd.8 | 4 +-
external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.c | 5 +-
external/ibm-public/postfix/dist/src/dnsblog/dnsblog.c | 13 +-
external/ibm-public/postfix/dist/src/global/mail_version.h | 6 +-
external/ibm-public/postfix/dist/src/local/Makefile.in | 1 +
external/ibm-public/postfix/dist/src/postlog/postlog.c | 3 +-
external/ibm-public/postfix/dist/src/postqueue/Makefile.in | 1 +
external/ibm-public/postfix/dist/src/postqueue/postqueue.c | 4 +-
external/ibm-public/postfix/dist/src/tls/tls.h | 19 ++-
external/ibm-public/postfix/dist/src/tls/tls_misc.c | 8 +-
external/ibm-public/postfix/dist/src/util/events.c | 8 +-
external/ibm-public/postfix/dist/src/xsasl/xsasl_cyrus.h | 7 +-
external/ibm-public/postfix/dist/src/xsasl/xsasl_cyrus_client.c | 10 +-
external/ibm-public/postfix/dist/src/xsasl/xsasl_cyrus_server.c | 4 +-
21 files changed, 223 insertions(+), 36 deletions(-)
diffs (truncated from 552 to 300 lines):
diff -r 08f97d126c80 -r 6fc92ea9802b external/ibm-public/postfix/dist/HISTORY
--- a/external/ibm-public/postfix/dist/HISTORY Sat Jun 09 09:22:21 2012 +0000
+++ b/external/ibm-public/postfix/dist/HISTORY Sat Jun 09 11:26:39 2012 +0000
@@ -16747,3 +16747,85 @@
have been updated when it was re-purposed to handle DSN
SUCCESS notifications. Problem reported by Sabahattin
Gucukoglu. File: bounce/bounce_trace_service.c.
+
+20120202
+
+ Bugfix (introduced: Postfix 2.3): the "change header" milter
+ request could replace the wrong header. A long header name
+ could match a shorter one, because a length check was done
+ on the wrong string. Reported by Vladimir Vassiliev. File:
+ cleanup/cleanup_milter.c.
+
+20120214
+
+ Bugfix (introduced: Postfix 2.4): extraneous null assignment
+ caused core dump when postlog emitted the "usage" message.
+ Reported by Kant (fnord.hammer). File: postlog/postlog.c.
+
+20120217
+
+ Cleanup: missing #include statement for bugfix code added
+ 20111226. File: local/unknown.c.
+
+20120401
+
+ Bitrot: shut up useless warnings about Cyrus SASL call-back
+ function pointer type mis-matches. Files: xsasl/xsasl_cyrus.h,
+ xsasl/xsasl_cyrus_server.c, xsasl/xsasl_client.c.
+
+20120422
+
+ Bit-rot: OpenSSL 1.0.1 introduces new protocols. Update the
+ known TLS protocol list so that protocols can be turned off
+ selectively to work around implementation bugs. Based on
+ a patch by Victor Duchovni. Files: proto/TLS_README.html,
+ proto/postconf.proto, tls/tls.h, tls/tls_misc.c, tls/tls_client.c,
+ tls/tls_server.c.
+
+20120425
+
+ Workaround: bugs in 10-year old gcc versions break compilation
+ with #ifdef inside a macro invocation (NOT: definition).
+ Files: tls/tls.h, tls/tls_client.c, tls/tls_server.c.
+
+20120516
+
+ Workaround: apparently, FreeBSD 8.3 kqueue notifications
+ sometimes break when a dnsblog(8) process loses an accept()
+ race on a shared socket, resulting in repeated "connect to
+ private/dnsblog service: Connection refused" warnings. This
+ condition is unique to dnsblog(8). The postscreen(8) daemon
+ closes a postscreen-to-dnsblog connection as soon as it
+ receives a dnsblog(8) reply, resulting in hundreds or
+ thousands of connection requests per second. All other
+ multi-server daemons such as anvil(8) or proxymap(8) have
+ connection lifetimes ranging from 5s to 1000s depending on
+ server load. The workaround is for dnsblog to use the
+ single_server driver instead of the multi_server driver.
+ This one-line code change eliminates the accept() race
+ without any Postfix performance impact. Problem reported
+ by Sahil Tandon. File: dnsblog/dnsblog.c.
+
+20120517
+
+ Workaround: to avoid crashes when the OpenSSL library is
+ updated without "postfix reload", the Postfix TLS session
+ cache ID now includes the OpenSSL library version number.
+ Note: this problem cannot be fixed in tlsmgr(8). Code by
+ Victor Duchovni. Files: tls/tls_server.c, tls_client.c.
+
+20120520
+
+ Bugfix (introduced Postfix 2.4): the event_drain() function
+ was comparing bitmasks incorrectly causing the program to
+ always wait for the full time limit. This error affected
+ the unused postkick command, but only after s/fifo/unix/
+ in master.cf. File: util/events.c.
+
+ Cleanup: laptop users have always been able to avoid
+ unnecessary disk spin-up by doing s/fifo/unix/ in master.cf
+ (this is currently not supported on Solaris systems).
+ However, to make this work reliably, the "postqueue -f"
+ command must wait until its requests have reached the pickup
+ and qmgr servers before closing the UNIX-domain request
+ sockets. Files: postqueue/postqueue.c, postqueue/Makefile.in.
diff -r 08f97d126c80 -r 6fc92ea9802b external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES
--- a/external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES Sat Jun 09 09:22:21 2012 +0000
+++ b/external/ibm-public/postfix/dist/README_FILES/RELEASE_NOTES Sat Jun 09 11:26:39 2012 +0000
@@ -11,6 +11,43 @@
The mail_release_date configuration parameter (format: yyyymmdd)
specifies the release date of a stable release or snapshot release.
+Major changes with Postfix 2.8.10
+---------------------------------
+
+This release adds support to turn off the TLSv1.1 and TLSv1.2
+protocols. Introduced with OpenSSL version 1.0.1, these are known
+to cause inter-operability problems with for example hotmail.
+
+The radical workaround is to temporarily turn off problematic
+protocols globally:
+
+/etc/postfix/main.cf:
+ smtp_tls_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
+ smtp_tls_mandatory_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
+
+ smtpd_tls_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
+ smtpd_tls_mandatory_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
+
+However, it may be better to temporarily turn off problematic
+protocols for broken sites only:
+
+/etc/postfix/main.cf:
+ smtp_tls_policy_maps = hash:/etc/postfix/tls_policy
+
+/etc/postfix/tls_policy:
+ example.com may protocols=!SSLv2:!TLSv1.1:!TLSv1.2
+
+Important:
+
+- Note the use of ":" instead of comma or space. Also, note that
+ there is NO space around the "=" in "protocols=".
+
+- The smtp_tls_policy_maps lookup key must match the "next-hop"
+ destination that is given to the Postfix SMTP client. If you
+ override the next-hop destination with transport_maps, relayhost,
+ sender_dependent_relayhost_maps, or otherwise, you need to specify
+ the same destination for the smtp_tls_policy_maps lookup key.
+
Incompatible changes with Postfix 2.8.2
---------------------------------------
diff -r 08f97d126c80 -r 6fc92ea9802b external/ibm-public/postfix/dist/RELEASE_NOTES
--- a/external/ibm-public/postfix/dist/RELEASE_NOTES Sat Jun 09 09:22:21 2012 +0000
+++ b/external/ibm-public/postfix/dist/RELEASE_NOTES Sat Jun 09 11:26:39 2012 +0000
@@ -11,6 +11,43 @@
The mail_release_date configuration parameter (format: yyyymmdd)
specifies the release date of a stable release or snapshot release.
+Major changes with Postfix 2.8.10
+---------------------------------
+
+This release adds support to turn off the TLSv1.1 and TLSv1.2
+protocols. Introduced with OpenSSL version 1.0.1, these are known
+to cause inter-operability problems with for example hotmail.
+
+The radical workaround is to temporarily turn off problematic
+protocols globally:
+
+/etc/postfix/main.cf:
+ smtp_tls_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
+ smtp_tls_mandatory_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
+
+ smtpd_tls_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
+ smtpd_tls_mandatory_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
+
+However, it may be better to temporarily turn off problematic
+protocols for broken sites only:
+
+/etc/postfix/main.cf:
+ smtp_tls_policy_maps = hash:/etc/postfix/tls_policy
+
+/etc/postfix/tls_policy:
+ example.com may protocols=!SSLv2:!TLSv1.1:!TLSv1.2
+
+Important:
+
+- Note the use of ":" instead of comma or space. Also, note that
+ there is NO space around the "=" in "protocols=".
+
+- The smtp_tls_policy_maps lookup key must match the "next-hop"
+ destination that is given to the Postfix SMTP client. If you
+ override the next-hop destination with transport_maps, relayhost,
+ sender_dependent_relayhost_maps, or otherwise, you need to specify
+ the same destination for the smtp_tls_policy_maps lookup key.
+
Incompatible changes with Postfix 2.8.2
---------------------------------------
diff -r 08f97d126c80 -r 6fc92ea9802b external/ibm-public/postfix/dist/html/lmtp.8.html
--- a/external/ibm-public/postfix/dist/html/lmtp.8.html Sat Jun 09 09:22:21 2012 +0000
+++ b/external/ibm-public/postfix/dist/html/lmtp.8.html Sat Jun 09 11:26:39 2012 +0000
@@ -455,7 +455,7 @@
non-empty value is specified, this overrides the
obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter.
- <b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (SSLv3, TLSv1)</b>
+ <b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (!SSLv2)</b>
List of SSL/TLS protocols that the Postfix SMTP
client will use with mandatory TLS encryption.
diff -r 08f97d126c80 -r 6fc92ea9802b external/ibm-public/postfix/dist/html/smtp.8.html
--- a/external/ibm-public/postfix/dist/html/smtp.8.html Sat Jun 09 09:22:21 2012 +0000
+++ b/external/ibm-public/postfix/dist/html/smtp.8.html Sat Jun 09 11:26:39 2012 +0000
@@ -455,7 +455,7 @@
non-empty value is specified, this overrides the
obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter.
- <b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (SSLv3, TLSv1)</b>
+ <b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (!SSLv2)</b>
List of SSL/TLS protocols that the Postfix SMTP
client will use with mandatory TLS encryption.
diff -r 08f97d126c80 -r 6fc92ea9802b external/ibm-public/postfix/dist/html/smtpd.8.html
--- a/external/ibm-public/postfix/dist/html/smtpd.8.html Sat Jun 09 09:22:21 2012 +0000
+++ b/external/ibm-public/postfix/dist/html/smtpd.8.html Sat Jun 09 11:26:39 2012 +0000
@@ -462,7 +462,7 @@
exclude from the SMTP server cipher list at manda-
tory TLS security levels.
- <b><a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> (SSLv3, TLSv1)</b>
+ <b><a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> (!SSLv2)</b>
The SSL/TLS protocols accepted by the Postfix SMTP
server with mandatory TLS encryption.
diff -r 08f97d126c80 -r 6fc92ea9802b external/ibm-public/postfix/dist/man/man8/smtp.8
--- a/external/ibm-public/postfix/dist/man/man8/smtp.8 Sat Jun 09 09:22:21 2012 +0000
+++ b/external/ibm-public/postfix/dist/man/man8/smtp.8 Sat Jun 09 11:26:39 2012 +0000
@@ -1,4 +1,4 @@
-.\" $NetBSD: smtp.8,v 1.1.1.3 2011/03/02 19:31:55 tron Exp $
+.\" $NetBSD: smtp.8,v 1.1.1.4 2012/06/09 11:27:00 tron Exp $
.\"
.TH SMTP 8
.ad
@@ -380,7 +380,7 @@
Optional lookup tables with the Postfix SMTP client TLS security
policy by next-hop destination; when a non-empty value is specified,
this overrides the obsolete smtp_tls_per_site parameter.
-.IP "\fBsmtp_tls_mandatory_protocols (SSLv3, TLSv1)\fR"
+.IP "\fBsmtp_tls_mandatory_protocols (!SSLv2)\fR"
List of SSL/TLS protocols that the Postfix SMTP client will use with
mandatory TLS encryption.
.IP "\fBsmtp_tls_scert_verifydepth (9)\fR"
diff -r 08f97d126c80 -r 6fc92ea9802b external/ibm-public/postfix/dist/man/man8/smtpd.8
--- a/external/ibm-public/postfix/dist/man/man8/smtpd.8 Sat Jun 09 09:22:21 2012 +0000
+++ b/external/ibm-public/postfix/dist/man/man8/smtpd.8 Sat Jun 09 11:26:39 2012 +0000
@@ -1,4 +1,4 @@
-.\" $NetBSD: smtpd.8,v 1.1.1.3 2011/03/02 19:31:55 tron Exp $
+.\" $NetBSD: smtpd.8,v 1.1.1.4 2012/06/09 11:27:00 tron Exp $
.\"
.TH SMTPD 8
.ad
@@ -391,7 +391,7 @@
.IP "\fBsmtpd_tls_mandatory_exclude_ciphers (empty)\fR"
Additional list of ciphers or cipher types to exclude from the
SMTP server cipher list at mandatory TLS security levels.
-.IP "\fBsmtpd_tls_mandatory_protocols (SSLv3, TLSv1)\fR"
+.IP "\fBsmtpd_tls_mandatory_protocols (!SSLv2)\fR"
The SSL/TLS protocols accepted by the Postfix SMTP server with
mandatory TLS encryption.
.IP "\fBsmtpd_tls_received_header (no)\fR"
diff -r 08f97d126c80 -r 6fc92ea9802b external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.c
--- a/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.c Sat Jun 09 09:22:21 2012 +0000
+++ b/external/ibm-public/postfix/dist/src/cleanup/cleanup_milter.c Sat Jun 09 11:26:39 2012 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: cleanup_milter.c,v 1.1.1.5 2011/07/31 10:02:32 tron Exp $ */
+/* $NetBSD: cleanup_milter.c,v 1.1.1.6 2012/06/09 11:27:09 tron Exp $ */
/*++
/* NAME
@@ -842,8 +842,7 @@
/* Reset the saved PTR record and update last_type. */ ;
else if ((header_label == 0
|| (strncasecmp(header_label, STR(buf), len) == 0
- && (IS_SPACE_TAB(STR(buf)[len])
- || STR(buf)[len] == ':')))
+ && (strlen(header_label) == len)))
&& --index == 0) {
/* If we have a saved PTR record, it points to start of header. */
break;
diff -r 08f97d126c80 -r 6fc92ea9802b external/ibm-public/postfix/dist/src/dnsblog/dnsblog.c
--- a/external/ibm-public/postfix/dist/src/dnsblog/dnsblog.c Sat Jun 09 09:22:21 2012 +0000
+++ b/external/ibm-public/postfix/dist/src/dnsblog/dnsblog.c Sat Jun 09 11:26:39 2012 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: dnsblog.c,v 1.1.1.2 2011/03/23 19:07:34 tron Exp $ */
+/* $NetBSD: dnsblog.c,v 1.1.1.3 2012/06/09 11:27:09 tron Exp $ */
/*++
/* NAME
@@ -259,6 +259,7 @@
query = vstring_alloc(100);
why = vstring_alloc(100);
result = vstring_alloc(100);
+ var_use_limit = 0;
}
MAIL_VERSION_STAMP_DECLARE;
@@ -277,9 +278,9 @@
*/
MAIL_VERSION_STAMP_ALLOCATE;
- multi_server_main(argc, argv, dnsblog_service,
- MAIL_SERVER_TIME_TABLE, time_table,
- MAIL_SERVER_POST_INIT, post_jail_init,
- MAIL_SERVER_UNLIMITED,
- 0);
Home |
Main Index |
Thread Index |
Old Index