Prereq: "2.6.7"
diff -cr --new-file /var/tmp/postfix-2.6.7/src/global/mail_version.h ./src/global/mail_version.h
*** /var/tmp/postfix-2.6.7/src/global/mail_version.h Tue Jun 8 08:40:49 2010
--- ./src/global/mail_version.h Tue Nov 23 11:16:32 2010
***************
*** 20,27 ****
* Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only.
*/
! #define MAIL_RELEASE_DATE "20100608"
! #define MAIL_VERSION_NUMBER "2.6.7"
#ifdef SNAPSHOT
# define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE
--- 20,27 ----
* Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only.
*/
! #define MAIL_RELEASE_DATE "20101123"
! #define MAIL_VERSION_NUMBER "2.6.8"
#ifdef SNAPSHOT
# define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE
diff -cr --new-file /var/tmp/postfix-2.6.7/HISTORY ./HISTORY
*** /var/tmp/postfix-2.6.7/HISTORY Fri Jun 4 08:42:54 2010
--- ./HISTORY Tue Nov 23 11:17:36 2010
***************
*** 15367,15369 ****
--- 15367,15409 ----
Portability: Berkeley DB 5.x has the same API as Berkeley
DB 4.1 and later. File: util/dict_db.c.
+
+ 20100610
+
+ Bugfix (introduced Postfix 2.2): Postfix no longer appends
+ the system default CA certificates to the lists specified
+ with *_tls_CAfile or with *_tls_CApath. This prevents
+ third-party certificates from getting mail relay permission
+ with the permit_tls_all_clientcerts feature. Unfortunately
+ this may cause compatibility problems with configurations
+ that rely on certificate verification for other purposes.
+ To get the old behavior, specify "tls_append_default_CA =
+ yes". Files: tls/tls_certkey.c, tls/tls_misc.c,
+ global/mail_params.h. proto/postconf.proto, mantools/postlink.
+
+ 20100714
+
+ Compatibility with Postfix < 2.3: fix 20061207 was incomplete
+ (undoing the change to bounce instead of defer after
+ pipe-to-command delivery fails with a signal). Fix by Thomas
+ Arnett. File: global/pipe_command.c.
+
+ 20100827
+
+ Performance: fix for poor smtpd_proxy_filter TCP performance
+ over loopback (127.0.0.1) connections. Problem reported by
+ Mark Martinec. Files: smtpd/smtpd_proxy.c.
+
+ 20101023
+
+ Cleanup: don't apply reject_rhsbl_helo to non-domain forms
+ such as network addresses. This would cause false positives
+ with dbl.spamhaus.org. File: smtpd/smtpd_check.c.
+
+ 20101117
+
+ Bugfix: the "421" reply after Milter error was overruled
+ by Postfix 1.1 code that replied with "503" for RFC 2821
+ compliance. We now make an exception for "final" replies,
+ as permitted by RFC. Solution by Victor Duchovni. File:
+ smtpd/smtpd.c.
diff -cr --new-file /var/tmp/postfix-2.6.7/RELEASE_NOTES ./RELEASE_NOTES
*** /var/tmp/postfix-2.6.7/RELEASE_NOTES Thu Oct 22 10:32:36 2009
--- ./RELEASE_NOTES Tue Nov 23 13:51:21 2010
***************
*** 14,19 ****
--- 14,31 ----
If you upgrade from Postfix 2.4 or earlier, read RELEASE_NOTES-2.5
before proceeding.
+ Incompatibility with Postfix 2.6.8
+ ----------------------------------
+
+ Postfix no longer appends the system-supplied default CA certificates
+ to the lists specified with *_tls_CAfile or with *_tls_CApath. This
+ prevents third-party certificates from getting mail relay permission
+ with the permit_tls_all_clientcerts feature.
+
+ Unfortunately this change may cause compatibility problems when
+ configurations rely on certificate verification for other purposes.
+ Specify "tls_append_default_CA = yes" for backwards compatibility.
+
Major changes - multi-instance support
--------------------------------------
diff -cr --new-file /var/tmp/postfix-2.6.7/html/postconf.5.html ./html/postconf.5.html
*** /var/tmp/postfix-2.6.7/html/postconf.5.html Wed Jun 2 08:30:15 2010
--- ./html/postconf.5.html Tue Jun 15 18:18:34 2010
***************
*** 8889,8894 ****
--- 8889,8898 ----
but it is best to include all the required certificates directly in
$smtp_tls_cert_file.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
Example:
***************
*** 8912,8917 ****
--- 8916,8925 ----
To use this option in chroot mode, this directory (or a copy)
must be inside the chroot jail.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
Example:
***************
*** 10523,10530 ****
Permit the request when the remote SMTP client certificate is
verified successfully. This option must be used only if a special
CA issues the certificates and only this CA is listed as trusted
! CA, otherwise all clients with a recognized certificate would be
! allowed to relay. This feature is available with Postfix version 2.2.
permit_tls_clientcerts
--- 10531,10541 ----
Permit the request when the remote SMTP client certificate is
verified successfully. This option must be used only if a special
CA issues the certificates and only this CA is listed as trusted
! CA. Otherwise, clients with a third-party certificate would also
! be allowed to relay. Specify "tls_append_default_CA = no" when the
! trusted CA is specified with smtpd_tls_CAfile or smtpd_tls_CApath,
! to prevent Postfix from appending the system-supplied default CAs.
! This feature is available with Postfix version 2.2.
permit_tls_clientcerts
***************
*** 12193,12198 ****
--- 12204,12213 ----
but it is best to include all the required certificates directly in the
server certificate file.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
By default (see smtpd_tls_ask_ccert), client certificates are not
requested, and smtpd_tls_CAfile should remain empty. If you do make use
of client certificates, the distinguished names (DNs) of the certificate
***************
*** 12224,12229 ****
--- 12239,12248 ----
smtpd_tls_CApath in chroot mode, this directory (or a copy) must be
inside the chroot jail.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
By default (see smtpd_tls_ask_ccert), client certificates are
not requested, and smtpd_tls_CApath should remain empty. In contrast
to smtp_tls_CAfile, DNs of certificate authorities installed
***************
*** 13343,13348 ****
--- 13362,13384 ----
+
tls_append_default_CA
+ (default: no)
+
+ Append the system-supplied default certificate authority
+ certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
+ The default is "no"; this prevents Postfix from trusting third-party
+ certificates and giving them relay permission with
+ permit_tls_all_clientcerts.
+
+ This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8,
+ 2.7.2 and later versions. Specify "tls_append_default_CA = yes" for
+ backwards compatibility, to avoid breaking certificate verification
+ with sites that don't use permit_tls_all_clientcerts.
+
+
+
+
tls_daemon_random_bytes
(default: 32)
diff -cr --new-file /var/tmp/postfix-2.6.7/man/man5/postconf.5 ./man/man5/postconf.5
*** /var/tmp/postfix-2.6.7/man/man5/postconf.5 Wed Jun 2 08:30:15 2010
--- ./man/man5/postconf.5 Tue Jun 15 18:18:34 2010
***************
*** 5046,5051 ****
--- 5046,5055 ----
but it is best to include all the required certificates directly in
$smtp_tls_cert_file.
.PP
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+ .PP
Example:
.PP
.nf
***************
*** 5066,5071 ****
--- 5070,5079 ----
To use this option in chroot mode, this directory (or a copy)
must be inside the chroot jail.
.PP
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+ .PP
Example:
.PP
.nf
***************
*** 6404,6411 ****
Permit the request when the remote SMTP client certificate is
verified successfully. This option must be used only if a special
CA issues the certificates and only this CA is listed as trusted
! CA, otherwise all clients with a recognized certificate would be
! allowed to relay. This feature is available with Postfix version 2.2.
.IP "\fBpermit_tls_clientcerts\fR"
Permit the request when the remote SMTP client certificate
fingerprint is listed in $relay_clientcerts.
--- 6412,6422 ----
Permit the request when the remote SMTP client certificate is
verified successfully. This option must be used only if a special
CA issues the certificates and only this CA is listed as trusted
! CA. Otherwise, clients with a third-party certificate would also
! be allowed to relay. Specify "tls_append_default_CA = no" when the
! trusted CA is specified with smtpd_tls_CAfile or smtpd_tls_CApath,
! to prevent Postfix from appending the system-supplied default CAs.
! This feature is available with Postfix version 2.2.
.IP "\fBpermit_tls_clientcerts\fR"
Permit the request when the remote SMTP client certificate
fingerprint is listed in $relay_clientcerts.
***************
*** 7519,7524 ****
--- 7530,7539 ----
but it is best to include all the required certificates directly in the
server certificate file.
.PP
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+ .PP
By default (see smtpd_tls_ask_ccert), client certificates are not
requested, and smtpd_tls_CAfile should remain empty. If you do make use
of client certificates, the distinguished names (DNs) of the certificate
***************
*** 7548,7553 ****
--- 7563,7572 ----
smtpd_tls_CApath in chroot mode, this directory (or a copy) must be
inside the chroot jail.
.PP
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+ .PP
By default (see smtpd_tls_ask_ccert), client certificates are
not requested, and smtpd_tls_CApath should remain empty. In contrast
to smtp_tls_CAfile, DNs of certificate authorities installed
***************
*** 8408,8413 ****
--- 8427,8443 ----
\fBlmtp\fR(8)).
.PP
This feature is available in Postfix 2.6 and later.
+ .SH tls_append_default_CA (default: no)
+ Append the system-supplied default certificate authority
+ certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
+ The default is "no"; this prevents Postfix from trusting third-party
+ certificates and giving them relay permission with
+ permit_tls_all_clientcerts.
+ .PP
+ This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8,
+ 2.7.2 and later versions. Specify "tls_append_default_CA = yes" for
+ backwards compatibility, to avoid breaking certificate verification
+ with sites that don't use permit_tls_all_clientcerts.
.SH tls_daemon_random_bytes (default: 32)
The number of pseudo-random bytes that an \fBsmtp\fR(8) or \fBsmtpd\fR(8)
process requests from the \fBtlsmgr\fR(8) server in order to seed its
diff -cr --new-file /var/tmp/postfix-2.6.7/mantools/postlink ./mantools/postlink
*** /var/tmp/postfix-2.6.7/mantools/postlink Sun Apr 26 20:35:34 2009
--- ./mantools/postlink Tue Jun 15 17:36:55 2010
***************
*** 665,670 ****
--- 665,671 ----
s;\btls_null_cipherlist\b;$&;g;
s;\btls_eecdh_strong_curve\b;$&;g;
s;\btls_eecdh_ultra_curve\b;$&;g;
+ s;\btls_append_default_CA\b;$&;g;
s;\bfrozen_delivered_to\b;$&;g;
diff -cr --new-file /var/tmp/postfix-2.6.7/proto/postconf.proto ./proto/postconf.proto
*** /var/tmp/postfix-2.6.7/proto/postconf.proto Wed Jun 2 08:28:22 2010
--- ./proto/postconf.proto Tue Jun 15 18:18:30 2010
***************
*** 4792,4799 ****
Permit the request when the remote SMTP client certificate is
verified successfully. This option must be used only if a special
CA issues the certificates and only this CA is listed as trusted
! CA, otherwise all clients with a recognized certificate would be
! allowed to relay. This feature is available with Postfix version 2.2.
permit_tls_clientcerts
--- 4792,4802 ----
Permit the request when the remote SMTP client certificate is
verified successfully. This option must be used only if a special
CA issues the certificates and only this CA is listed as trusted
! CA. Otherwise, clients with a third-party certificate would also
! be allowed to relay. Specify "tls_append_default_CA = no" when the
! trusted CA is specified with smtpd_tls_CAfile or smtpd_tls_CApath,
! to prevent Postfix from appending the system-supplied default CAs.
! This feature is available with Postfix version 2.2.
permit_tls_clientcerts
***************
*** 8535,8540 ****
--- 8538,8547 ----
but it is best to include all the required certificates directly in the
server certificate file.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
By default (see smtpd_tls_ask_ccert), client certificates are not
requested, and smtpd_tls_CAfile should remain empty. If you do make use
of client certificates, the distinguished names (DNs) of the certificate
***************
*** 8562,8567 ****
--- 8569,8578 ----
smtpd_tls_CApath in chroot mode, this directory (or a copy) must be
inside the chroot jail.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
By default (see smtpd_tls_ask_ccert), client certificates are
not requested, and smtpd_tls_CApath should remain empty. In contrast
to smtp_tls_CAfile, DNs of certificate authorities installed
***************
*** 8930,8935 ****
--- 8941,8950 ----
but it is best to include all the required certificates directly in
$smtp_tls_cert_file.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
Example:
***************
*** 8949,8954 ****
--- 8964,8973 ----
To use this option in chroot mode, this directory (or a copy)
must be inside the chroot jail.
+ Specify "tls_append_default_CA = no" to prevent Postfix from
+ appending the system-supplied default CAs and trusting third-party
+ certificates.
+
Example:
***************
*** 9238,9243 ****
--- 9257,9275 ----
This feature is available in Postfix 2.2 and later.
+ %PARAM tls_append_default_CA no
+
+ Append the system-supplied default certificate authority
+ certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
+ The default is "no"; this prevents Postfix from trusting third-party
+ certificates and giving them relay permission with
+ permit_tls_all_clientcerts.
+
+ This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8,
+ 2.7.2 and later versions. Specify "tls_append_default_CA = yes" for
+ backwards compatibility, to avoid breaking certificate verification
+ with sites that don't use permit_tls_all_clientcerts.
+
%PARAM tls_random_exchange_name see "postconf -d" output
Name of the pseudo random number generator (PRNG) state file
diff -cr --new-file /var/tmp/postfix-2.6.7/src/global/mail_params.h ./src/global/mail_params.h
*** /var/tmp/postfix-2.6.7/src/global/mail_params.h Wed Jun 2 08:28:21 2010
--- ./src/global/mail_params.h Tue Jun 15 17:36:55 2010
***************
*** 615,620 ****
--- 615,624 ----
#define DEF_DUP_FILTER_LIMIT 1000
extern int var_dup_filter_limit;
+ #define VAR_TLS_APPEND_DEF_CA "tls_append_default_CA"
+ #define DEF_TLS_APPEND_DEF_CA 0 /* Postfix < 2.8 BC break */
+ extern bool var_tls_append_def_CA;
+
#define VAR_TLS_RAND_EXCH_NAME "tls_random_exchange_name"
#define DEF_TLS_RAND_EXCH_NAME "${data_directory}/prng_exch"
extern char *var_tls_rand_exch_name;
diff -cr --new-file /var/tmp/postfix-2.6.7/src/global/pipe_command.c ./src/global/pipe_command.c
*** /var/tmp/postfix-2.6.7/src/global/pipe_command.c Tue Jan 8 16:01:16 2008
--- ./src/global/pipe_command.c Wed Jul 14 15:14:11 2010
***************
*** 628,634 ****
*/
if (!NORMAL_EXIT_STATUS(wait_status)) {
if (WIFSIGNALED(wait_status)) {
! dsb_unix(why, "5.3.0", log_len ?
log_buf : sys_exits_detail(EX_SOFTWARE)->text,
"Command died with signal %d: \"%s\"%s%s",
WTERMSIG(wait_status), args.command,
--- 628,634 ----
*/
if (!NORMAL_EXIT_STATUS(wait_status)) {
if (WIFSIGNALED(wait_status)) {
! dsb_unix(why, "4.3.0", log_len ?
log_buf : sys_exits_detail(EX_SOFTWARE)->text,
"Command died with signal %d: \"%s\"%s%s",
WTERMSIG(wait_status), args.command,
diff -cr --new-file /var/tmp/postfix-2.6.7/src/smtpd/smtpd.c ./src/smtpd/smtpd.c
*** /var/tmp/postfix-2.6.7/src/smtpd/smtpd.c Fri Mar 19 20:44:11 2010
--- ./src/smtpd/smtpd.c Mon Nov 22 15:59:30 2010
***************
*** 4452,4457 ****
--- 4452,4462 ----
}
/* XXX We use the real client for connect access control. */
if (state->access_denied && cmdp->action != quit_cmd) {
+ /* XXX Exception for Milter override. */
+ if (strncmp(state->access_denied + 1, "21", 2) == 0) {
+ smtpd_chat_reply(state, "%s", state->access_denied);
+ continue;
+ }
smtpd_chat_reply(state, "503 5.7.0 Error: access denied for %s",
state->namaddr); /* RFC 2821 Sec 3.1 */
state->error_count++;
diff -cr --new-file /var/tmp/postfix-2.6.7/src/smtpd/smtpd_check.c ./src/smtpd/smtpd_check.c
*** /var/tmp/postfix-2.6.7/src/smtpd/smtpd_check.c Fri Aug 28 20:29:22 2009
--- ./src/smtpd/smtpd_check.c Mon Nov 22 12:47:04 2010
***************
*** 3755,3761 ****
name);
else {
cpp += 1;
! if (state->helo_name)
status = reject_rbl_domain(state, *cpp, state->helo_name,
SMTPD_NAME_HELO);
}
--- 3755,3762 ----
name);
else {
cpp += 1;
! if (state->helo_name
! && valid_hostname(state->helo_name, DONT_GRIPE))
status = reject_rbl_domain(state, *cpp, state->helo_name,
SMTPD_NAME_HELO);
}
diff -cr --new-file /var/tmp/postfix-2.6.7/src/smtpd/smtpd_proxy.c ./src/smtpd/smtpd_proxy.c
*** /var/tmp/postfix-2.6.7/src/smtpd/smtpd_proxy.c Fri Mar 6 15:42:40 2009
--- ./src/smtpd/smtpd_proxy.c Fri Aug 27 19:35:41 2010
***************
*** 304,309 ****
--- 304,312 ----
}
state->proxy = vstream_fdopen(fd, O_RDWR);
vstream_control(state->proxy, VSTREAM_CTL_PATH, service, VSTREAM_CTL_END);
+ /* Avoid poor performance when TCP MSS > VSTREAM_BUFSIZE. */
+ if (connect_fn == inet_connect)
+ vstream_tweak_tcp(state->proxy);
smtp_timeout_setup(state->proxy, timeout);
/*
diff -cr --new-file /var/tmp/postfix-2.6.7/src/tls/Makefile.in ./src/tls/Makefile.in
*** /var/tmp/postfix-2.6.7/src/tls/Makefile.in Thu Jan 15 16:36:39 2009
--- ./src/tls/Makefile.in Wed Jul 7 05:25:57 2010
***************
*** 101,106 ****
--- 101,107 ----
tls_bio_ops.o: tls.h
tls_bio_ops.o: tls_bio_ops.c
tls_certkey.o: ../../include/argv.h
+ tls_certkey.o: ../../include/mail_params.h
tls_certkey.o: ../../include/msg.h
tls_certkey.o: ../../include/name_code.h
tls_certkey.o: ../../include/name_mask.h
diff -cr --new-file /var/tmp/postfix-2.6.7/src/tls/tls_certkey.c ./src/tls/tls_certkey.c
*** /var/tmp/postfix-2.6.7/src/tls/tls_certkey.c Wed Jun 2 08:28:22 2010
--- ./src/tls/tls_certkey.c Tue Jun 15 17:36:55 2010
***************
*** 70,75 ****
--- 70,79 ----
#include
+ /* Global library. */
+
+ #include
+
/* TLS library. */
#define TLS_INTERNAL
***************
*** 91,97 ****
tls_print_errors();
return (-1);
}
! if (!SSL_CTX_set_default_verify_paths(ctx)) {
msg_info("cannot set certificate verification paths: "
"disabling TLS support");
tls_print_errors();
--- 95,101 ----
tls_print_errors();
return (-1);
}
! if (var_tls_append_def_CA && !SSL_CTX_set_default_verify_paths(ctx)) {
msg_info("cannot set certificate verification paths: "
"disabling TLS support");
tls_print_errors();
diff -cr --new-file /var/tmp/postfix-2.6.7/src/tls/tls_misc.c ./src/tls/tls_misc.c
*** /var/tmp/postfix-2.6.7/src/tls/tls_misc.c Sat Nov 8 18:35:28 2008
--- ./src/tls/tls_misc.c Wed Jul 7 07:04:43 2010
***************
*** 15,20 ****
--- 15,21 ----
/* char *var_tls_eecdh_strong;
/* char *var_tls_eecdh_ultra;
/* int var_tls_daemon_rand_bytes;
+ /* bool var_tls_append_def_CA;
/*
/* TLS_APPL_STATE *tls_alloc_app_context(ssl_ctx)
/* SSL_CTX *ssl_ctx;
***************
*** 190,195 ****
--- 191,197 ----
int var_tls_daemon_rand_bytes;
char *var_tls_eecdh_strong;
char *var_tls_eecdh_ultra;
+ bool var_tls_append_def_CA;
/*
* Index to attach TLScontext pointers to SSL objects, so that they can be
***************
*** 407,412 ****
--- 409,418 ----
VAR_TLS_DAEMON_RAND_BYTES, DEF_TLS_DAEMON_RAND_BYTES, &var_tls_daemon_rand_bytes, 1, 0,
0,
};
+ static const CONFIG_BOOL_TABLE bool_table[] = {
+ VAR_TLS_APPEND_DEF_CA, DEF_TLS_APPEND_DEF_CA, &var_tls_append_def_CA,
+ 0,
+ };
static int init_done;
if (init_done)
***************
*** 415,420 ****
--- 421,427 ----
get_mail_conf_str_table(str_table);
get_mail_conf_int_table(int_table);
+ get_mail_conf_bool_table(bool_table);
}
/* tls_set_ciphers - Set SSL context cipher list */