postfix-3.4.17

diff --git a/postfix/HISTORY b/postfix/HISTORY
index be605681c4ce6d8a0b8ae32e47d4c241ceb2feeb..3c7ea9c09931acfb8537d5e017393799435679e8 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -24494,3 +24494,18 @@ Apologies for any names omitted.
        the system-wide OpenSSL configuration of allowed TLS protocol
        versions, for sessions where the remote SMTP client sends
        SNI. It's better to be safe than sorry. File: tls/tls_server.c.
+
+20200821
+
+       Bugfix (introduced: Postfix 3.4, already fixed in Postfix
+       3.6): tlsproxy(8) was using the wrong DANE macro for
+       connections with DANE trust anchors or with non-DANE trust
+       anchors (WTF: Thorsten Habich found this bug in the use
+       case that has nothing to do with DANE). This resulted in a
+       global certificate verify function pointer race, between
+       TLS handshakes that use TLS trust achors and handshakes
+       that use PKI. No memory was corrupted in the course of all
+       this.  Viktor Dukhovni. File: tlsproxy/tlsproxy.c.
+
+       Cleanup: the posttls-finger '-X' option reported a false
+       conflict with '-r'.  File: posttls-finger/posttls-finger.c.

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 00829b66fec677c5891567f3f822b2d737d51f29..c71a040e67ffa6ed1643ada7c25185d932e77c13 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20200726"
-#define MAIL_VERSION_NUMBER    "3.4.16"
+#define MAIL_RELEASE_DATE      "20200830"
+#define MAIL_VERSION_NUMBER    "3.4.17"
 
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE      "-" MAIL_RELEASE_DATE

diff --git a/postfix/src/posttls-finger/posttls-finger.c b/postfix/src/posttls-finger/posttls-finger.c
index c142d43f5ae421aafc47f6fad1ba446eb7a582b4..a3a9946d327b7288ad5c68a2a8910ffa07033b87 100644 (file)
--- a/postfix/src/posttls-finger/posttls-finger.c
+++ b/postfix/src/posttls-finger/posttls-finger.c
@@ -1988,7 +1988,7 @@ static void parse_options(STATE *state, int argc, char *argv[])
        msg_fatal("bad '-a' option value: %s", state->options.addr_pref);
 
 #ifdef USE_TLS
-    if (state->tlsproxy_mode && state->reconnect)
+    if (state->tlsproxy_mode && state->reconnect >= 0)
        msg_fatal("The -X and -r options are mutually exclusive");
 #endif
 

diff --git a/postfix/src/tlsproxy/tlsproxy.c b/postfix/src/tlsproxy/tlsproxy.c
index ab24fff76b9a330093998a83d34a43b2556c1c79..216d000b82359f8f03d4ca783f3cf352bc8642aa 100644 (file)
--- a/postfix/src/tlsproxy/tlsproxy.c
+++ b/postfix/src/tlsproxy/tlsproxy.c
@@ -994,8 +994,17 @@ static int tlsp_client_start_pre_handshake(TLSP_STATE *state)
     state->client_start_props->fd = state->ciphertext_fd;
     /* These predicates and warning belong inside tls_client_start(). */
     if (!tls_dane_avail()                      /* mandatory side effects!! */
-       &&TLS_DANE_BASED(state->client_start_props->tls_level))
-       msg_warn("%s: DANE requested, but not available",
+
+    /*
+     * Why not test for TLS_DANE_BASED()? Because the tlsproxy(8) client has
+     * already converted its DANE TLSA records into trust anchors, and
+     * therefore TLS_DANE_HASTA() will be true instead. That exercises the
+     * code path that updates the shared SSL_CTX with custom X.509
+     * verification callbacks for trust anchors.
+     */
+       &&TLS_DANE_HASTA(state->client_start_props->dane))
+       msg_warn("%s: DANE or local trust anchor based chain"
+                " verification requested, but not available",
                 state->client_start_props->namaddr);
     else
        state->tls_context = tls_client_start(state->client_start_props);
@@ -1423,7 +1432,15 @@ static void tlsp_get_request_event(int event, void *context)
        }
        state->appl_state = tlsp_client_init(state->tls_params,
                                             state->client_init_props,
-                     TLS_DANE_BASED(state->client_start_props->tls_level));
+
+       /*
+        * Why not test for TLS_DANE_BASED()? Because the tlsproxy(8) client
+        * has already converted its DANE TLSA records into trust anchors,
+        * and therefore TLS_DANE_HASTA() will be true instead. That
+        * exercises the code path that updates the shared SSL_CTX with
+        * custom X.509 verification callbacks for trust anchors.
+        */
+                     TLS_DANE_HASTA(state->client_start_props->dane) != 0);
        ready = state->appl_state != 0;
        break;
     case TLS_PROXY_FLAG_ROLE_SERVER: