postfix-3.4.15

diff --git a/postfix/HISTORY b/postfix/HISTORY
index 11d3615e6caaa0fabf4ef1a7f2751837111bcfef..d532ee9d49640a796a0d8a7c33b154ef1e577cb1 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -24466,3 +24466,21 @@ Apologies for any names omitted.
        for the expanded CNAME. Therefore, sending the correct SNI
        name should not break existing mail flows. Fixed by Viktor
        Dukhovni. File: src/tls/tls_client.c.
+
+20200710
+
+       Bugfix (introduced: Postfix 3.0): minor memory leaks in the
+       Postfix TLS library, found during tests. File: tls/tls_misc.c.
+
+20200712
+
+       Bugfix (introduced: Postfix 3.0): 4kbyte per session memory
+       leak in the Postfix TLS library, found during tests. File:
+       tls/tls_misc.c.
+
+20200724
+
+       Workaround for distros that override Postfix protocol
+       settings in a system-wide OpenSSL configuration file, causing
+       interoperability problems after an OS update. File:
+       tls/tls_client.c, tls/tls_server.c.

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index ee31b0f22b741fb1b02c35a88dae36daeff1991d..8fcc05351e56898f90d713a5f8653f148facecc7 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20200627"
-#define MAIL_VERSION_NUMBER    "3.4.14"
+#define MAIL_RELEASE_DATE      "20200724"
+#define MAIL_VERSION_NUMBER    "3.4.15"
 
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE      "-" MAIL_RELEASE_DATE

diff --git a/postfix/src/tls/tls_client.c b/postfix/src/tls/tls_client.c
index 0b10620ef280e66b330dd070ae88ac56df085dd7..f3263b6dc5825cf9e24615bccc5404b2c2bde107 100644 (file)
--- a/postfix/src/tls/tls_client.c
+++ b/postfix/src/tls/tls_client.c
@@ -409,6 +409,11 @@ TLS_APPL_STATE *tls_client_init(const TLS_CLIENT_INIT_PROPS *props)
     off |= tls_bug_bits();
     SSL_CTX_set_options(client_ctx, off);
 
+    /* Enable all supported protocols */
+#if OPENSSL_VERSION_NUMBER >= 0x1010000fUL
+    SSL_CTX_set_min_proto_version(client_ctx, 0);
+#endif
+
     /*
      * Set the call-back routine for verbose logging.
      */

diff --git a/postfix/src/tls/tls_misc.c b/postfix/src/tls/tls_misc.c
index 1a1fd960898244946b0eed58369fa1d66028a456..3ecaa0537f3bac3f3c916d4c8827807baf652ba1 100644 (file)
--- a/postfix/src/tls/tls_misc.c
+++ b/postfix/src/tls/tls_misc.c
@@ -923,6 +923,8 @@ void    tls_get_signature_params(TLS_SESS_STATE *TLScontext)
         */
        if (SSL_get_signature_nid(ssl, &nid) && nid != NID_undef)
            locl_sig_dgst = OBJ_nid2sn(nid);
+
+       X509_free(cert);
     }
     /* Signature algorithms for the peer end of the connection */
     if ((cert = SSL_get_peer_certificate(ssl)) != 0) {
@@ -1159,6 +1161,22 @@ void    tls_free_context(TLS_SESS_STATE *TLScontext)
        myfree(TLScontext->peer_cert_fprint);
     if (TLScontext->peer_pkey_fprint)
        myfree(TLScontext->peer_pkey_fprint);
+    if (TLScontext->kex_name)
+       myfree((void *) TLScontext->kex_name);
+    if (TLScontext->kex_curve)
+       myfree((void *) TLScontext->kex_curve);
+    if (TLScontext->clnt_sig_name)
+       myfree((void *) TLScontext->clnt_sig_name);
+    if (TLScontext->clnt_sig_curve)
+       myfree((void *) TLScontext->clnt_sig_curve);
+    if (TLScontext->clnt_sig_dgst)
+       myfree((void *) TLScontext->clnt_sig_dgst);
+    if (TLScontext->srvr_sig_name)
+       myfree((void *) TLScontext->srvr_sig_name);
+    if (TLScontext->srvr_sig_curve)
+       myfree((void *) TLScontext->srvr_sig_curve);
+    if (TLScontext->srvr_sig_dgst)
+       myfree((void *) TLScontext->srvr_sig_dgst);
     if (TLScontext->errorcert)
        X509_free(TLScontext->errorcert);
     if (TLScontext->untrusted)

diff --git a/postfix/src/tls/tls_server.c b/postfix/src/tls/tls_server.c
index 6c0328de61fac12058c264175e5b3d28ffd9d90a..3d814f9d4dcec5b74935337e0679a76dae7c05a4 100644 (file)
--- a/postfix/src/tls/tls_server.c
+++ b/postfix/src/tls/tls_server.c
@@ -527,6 +527,11 @@ TLS_APPL_STATE *tls_server_init(const TLS_SERVER_INIT_PROPS *props)
 
     SSL_CTX_set_options(server_ctx, off);
 
+    /* Enable all supported protocols */
+#if OPENSSL_VERSION_NUMBER >= 0x1010000fUL
+    SSL_CTX_set_min_proto_version(server_ctx, 0);
+#endif
+
     /*
      * Global protocol selection.
      */