postfix-2.9.8

diff --git a/postfix/HISTORY b/postfix/HISTORY
index 28e0c2694969fd96fee73ebe8f72caa0d729211b..53d3826adfedd927de0fedb7e0909289b23561cc 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -17811,3 +17811,26 @@ Apologies for any names omitted.
        between different hostnames that resolve to the same IP
        address.  Found during Postfix 2.11 code maintenance.  File:
        smtp/smtp_connect.c.
+
+20130518
+
+       Bugfix (introduced: 1997): memory leak after error while
+       forwarding mail through the cleanup server. Viktor found
+       one, Wietse eliminated the rest.  File: local/forward.c.
+
+20130615
+
+       TLS Interoperability: turn on SHA-2 digests by force.  This
+       improves interoperability with clients and servers that
+       deploy SHA-2 digests without the required support for
+       TLSv1.2-style digest negotiation.  Based on patch by Viktor
+       Dukhovni.  Files: tls/tls_client.c, tls/tls_server.c.
+
+20130616
+
+       Workaround: The Postfix SMTP server TLS session cache was
+       broken because OpenSSL now enables session tickets by
+       default, resulting in a different ticket encryption key for
+       each smtpd(8) process.  The workaround turns off session
+       tickets. In 2.11 we'll enable session tickets properly.
+       Viktor Dukhovni. File: tls/tls_server.c.

diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES
index 719c1db4f5ed32e56a1a4f501c589edfcd8c2bdd..9e4a9227892d8c054b538127a57fb4c5f4eddf1a 100644 (file)
--- a/postfix/RELEASE_NOTES
+++ b/postfix/RELEASE_NOTES
@@ -14,6 +14,36 @@ specifies the release date of a stable release or snapshot release.
 If you upgrade from Postfix 2.7 or earlier, read RELEASE_NOTES-2.8
 before proceeding.
 
+Debian Exim before 4.80-3 interoperability workaround
+-----------------------------------------------------
+
+Debian Exim versions before 4.80-3 may fail to communicate with
+Postfix and possibly other MTAs, with the following Exim SMTP client
+error message:
+
+    TLS error on connection to server-name [server-address]
+    (gnutls_handshake): The Diffie-Hellman prime sent by the server
+    is not acceptable (not long enough)
+
+This problem may affect Debian Exim versions before 4.80-3 that use
+TLS with EDH (Ephemeral Diffie-Hellman) key exchanges. For details
+see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=676563
+
+To restore Postfix SMTP server interoperability with affected Exim
+SMTP clients, configure the Postfix SMTP server to use a 2048-bit
+prime number instead of 1024:
+
+    # cd /etc/postfix
+    # openssl dhparam -out dh2048.pem 2048
+    # postconf -e 'smtpd_tls_dh1024_param_file = ${config_directory}/dh2048.pem'
+
+This change increases the CPU cost of EDH key exchanges (rarely a
+problem for SMTP servers) and is unlikely to cause problems with
+other SMTP client implementations.
+
+This problem should not affect EECDH (Ephemeral Elliptic Curve
+Diffie-Hellman) key exchanges.
+
 Major changes with Postfix 2.9.6
 --------------------------------
 

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index ae372d6a3fdd97d9330657b8fcda48387a1e9869..4e18c453733bcc8419b6c478dfbd4cf520c782cd 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20130622"
-#define MAIL_VERSION_NUMBER    "2.9.7"
+#define MAIL_RELEASE_DATE      "20130905"
+#define MAIL_VERSION_NUMBER    "2.9.8"
 
 #ifdef SNAPSHOT
 # define MAIL_VERSION_DATE     "-" MAIL_RELEASE_DATE

diff --git a/postfix/src/local/forward.c b/postfix/src/local/forward.c
index 6ebe74f18d56f09722db787c4c9aa7bf2022a712..fb7da4f2ec82996bb211fd0b27b52f2b6191c489 100644 (file)
--- a/postfix/src/local/forward.c
+++ b/postfix/src/local/forward.c
@@ -118,6 +118,11 @@ static FORWARD_INFO *forward_open(DELIVER_REQUEST *request, const char *sender)
     FORWARD_INFO *info;
     VSTREAM *cleanup;
 
+#define FORWARD_OPEN_RETURN(res) do { \
+       vstring_free(buffer); \
+       return (res); \
+    } while (0)
+
     /*
      * Contact the cleanup service and save the new mail queue id. Request
      * that the cleanup service bounces bad messages to the sender so that we
@@ -129,13 +134,13 @@ static FORWARD_INFO *forward_open(DELIVER_REQUEST *request, const char *sender)
      */
     cleanup = mail_connect(MAIL_CLASS_PUBLIC, var_cleanup_service, BLOCKING);
     if (cleanup == 0)
-       return (0);
+       FORWARD_OPEN_RETURN(0);
     close_on_exec(vstream_fileno(cleanup), CLOSE_ON_EXEC);
     if (attr_scan(cleanup, ATTR_FLAG_STRICT,
                  ATTR_TYPE_STR, MAIL_ATTR_QUEUEID, buffer,
                  ATTR_TYPE_END) != 1) {
        vstream_fclose(cleanup);
-       return (0);
+       FORWARD_OPEN_RETURN(0);
     }
     info = (FORWARD_INFO *) mymalloc(sizeof(FORWARD_INFO));
     info->cleanup = cleanup;
@@ -190,8 +195,7 @@ static FORWARD_INFO *forward_open(DELIVER_REQUEST *request, const char *sender)
     PASS_ATTR(cleanup, MAIL_ATTR_LOG_IDENT, request->log_ident);
     PASS_ATTR(cleanup, MAIL_ATTR_RWR_CONTEXT, request->rewrite_context);
 
-    vstring_free(buffer);
-    return (info);
+    FORWARD_OPEN_RETURN(info);
 }
 
 /* forward_append - append recipient to message envelope */

diff --git a/postfix/src/tls/tls_client.c b/postfix/src/tls/tls_client.c
index 2252b00fa8e72b1cce8ae0a249b8372b3f898ab8..1a1e305cfa5096df419a80c7d455c198f6e1c390 100644 (file)
--- a/postfix/src/tls/tls_client.c
+++ b/postfix/src/tls/tls_client.c
@@ -335,6 +335,24 @@ TLS_APPL_STATE *tls_client_init(const TLS_CLIENT_INIT_PROPS *props)
        }
     }
 
+    /*
+     * Register SHA-2 digests, if implemented and not already registered.
+     * Improves interoperability with clients and servers that prematurely
+     * deploy SHA-2 certificates.
+     */
+#if defined(LN_sha256) && defined(NID_sha256) && !defined(OPENSSL_NO_SHA256)
+    if (!EVP_get_digestbyname(LN_sha224))
+       EVP_add_digest(EVP_sha224());
+    if (!EVP_get_digestbyname(LN_sha256))
+       EVP_add_digest(EVP_sha256());
+#endif
+#if defined(LN_sha512) && defined(NID_sha512) && !defined(OPENSSL_NO_SHA512)
+    if (!EVP_get_digestbyname(LN_sha384))
+       EVP_add_digest(EVP_sha384());
+    if (!EVP_get_digestbyname(LN_sha512))
+       EVP_add_digest(EVP_sha512());
+#endif
+
     /*
      * If the administrator specifies an unsupported digest algorithm, fail
      * now, rather than in the middle of a TLS handshake.

diff --git a/postfix/src/tls/tls_server.c b/postfix/src/tls/tls_server.c
index f0ebf669c5046a2fbe299ca562f4ea4c8cb3b654..441d24ca2a1db9e22b5557bd5c857404c33623ff 100644 (file)
--- a/postfix/src/tls/tls_server.c
+++ b/postfix/src/tls/tls_server.c
@@ -340,6 +340,24 @@ TLS_APPL_STATE *tls_server_init(const TLS_SERVER_INIT_PROPS *props)
        }
     }
 
+    /*
+     * Register SHA-2 digests, if implemented and not already registered.
+     * Improves interoperability with clients and servers that prematurely
+     * deploy SHA-2 certificates.
+     */
+#if defined(LN_sha256) && defined(NID_sha256) && !defined(OPENSSL_NO_SHA256)
+    if (!EVP_get_digestbyname(LN_sha224))
+       EVP_add_digest(EVP_sha224());
+    if (!EVP_get_digestbyname(LN_sha256))
+       EVP_add_digest(EVP_sha256());
+#endif
+#if defined(LN_sha512) && defined(NID_sha512) && !defined(OPENSSL_NO_SHA512)
+    if (!EVP_get_digestbyname(LN_sha384))
+       EVP_add_digest(EVP_sha384());
+    if (!EVP_get_digestbyname(LN_sha512))
+       EVP_add_digest(EVP_sha512());
+#endif
+
     /*
      * If the administrator specifies an unsupported digest algorithm, fail
      * now, rather than in the middle of a TLS handshake.
@@ -395,6 +413,9 @@ TLS_APPL_STATE *tls_server_init(const TLS_SERVER_INIT_PROPS *props)
     /*
      * Protocol work-arounds, OpenSSL version dependent.
      */
+#ifdef SSL_OP_NO_TICKET
+    off |= SSL_OP_NO_TICKET;
+#endif
     off |= tls_bug_bits();
     SSL_CTX_set_options(server_ctx, off);