postfix-3.10-20240924

diff --git a/postfix/HISTORY b/postfix/HISTORY
index 616323f8be5d35c1455d46e8122f7adc8703e301..dcf6e2a54fcbf512715ac55d240833bfd7041681 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -28236,3 +28236,8 @@ Apologies for any names omitted.
        "peer" key, and may need to fall back on the (new with
        OpenSSL 3.2) SSL_get0_group_name() function. Viktor Dukhovni.
        Files: src/tls/tls.h, src/tls/tls_dh.c, src/tls/tls_misc.c.
+
+20240924
+
+       Misc. cleanups. Viktor Dukhovni. Files: src/tls/tls_dh.c,
+       proto/postconf.proto, src/global/mail_params.h.

diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html
index 988b6f4d9c32ef53489deb7d45a04b2471a80602..d3fbf24e34a5c7d847f522af710287996e3523c7 100644 (file)
--- a/postfix/html/postconf.5.html
+++ b/postfix/html/postconf.5.html
@@ -20299,7 +20299,7 @@ EC key agreement in OpenSSL 3.0 and later.  Note that at least one of
 this is required by OpenSSL 3.0.  If both are inadvertently set empty,
 Postfix will fall back to the compiled-in defaults. </p>
 
-<p> All the default groups and EC curves should sufficiently strong to make
+<p> All the default groups and EC curves should be sufficiently strong to make
 "pruning" the defaults unwise.  At a minimum, "x25519" and "prime256v1" (the
 OpenSSL name for "secp256r1", a.k.a. "P-256") should be among the enabled EC
 curves, while "dhe2048" and "dhe3072" should be among the FFDHE groups. </p>

diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5
index 7e367f164ccd93f756aa73caf3152f39f89d01b7..339b388530aacaa5c5f0db6c711a130c3da3de49 100644 (file)
--- a/postfix/man/man5/postconf.5
+++ b/postfix/man/man5/postconf.5
@@ -14121,7 +14121,7 @@ EC key agreement in OpenSSL 3.0 and later.  Note that at least one of
 this is required by OpenSSL 3.0.  If both are inadvertently set empty,
 Postfix will fall back to the compiled\-in defaults.
 .PP
-All the default groups and EC curves should sufficiently strong to make
+All the default groups and EC curves should be sufficiently strong to make
 "pruning" the defaults unwise.  At a minimum, "x25519" and "prime256v1" (the
 OpenSSL name for "secp256r1", a.k.a. "P\-256") should be among the enabled EC
 curves, while "dhe2048" and "dhe3072" should be among the FFDHE groups.

diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto
index d0f3bd14549741da511039349c489633f203cbba..d8e9084795d978433f0fde2c9aeaa624a48dbdac 100644 (file)
--- a/postfix/proto/postconf.proto
+++ b/postfix/proto/postconf.proto
@@ -13426,7 +13426,7 @@ EC key agreement in OpenSSL 3.0 and later.  Note that at least one of
 this is required by OpenSSL 3.0.  If both are inadvertently set empty,
 Postfix will fall back to the compiled-in defaults. </p>
 
-<p> All the default groups and EC curves should sufficiently strong to make
+<p> All the default groups and EC curves should be sufficiently strong to make
 "pruning" the defaults unwise.  At a minimum, "x25519" and "prime256v1" (the
 OpenSSL name for "secp256r1", a.k.a. "P-256") should be among the enabled EC
 curves, while "dhe2048" and "dhe3072" should be among the FFDHE groups. </p>

diff --git a/postfix/src/global/mail_params.h b/postfix/src/global/mail_params.h
index 1d61fde533839d8f87bc8c6f04e57e8d5624be7d..908341ae37e8a9f17ee9204c44ea933d10eac97e 100644 (file)
--- a/postfix/src/global/mail_params.h
+++ b/postfix/src/global/mail_params.h
@@ -3399,21 +3399,25 @@ extern char *var_tls_null_clist;
 #else
 #define DEF_TLS_EECDH_AUTO_1 ""
 #endif
+
 #if defined(SN_X448) && defined(NID_X448)
 #define DEF_TLS_EECDH_AUTO_2 SN_X448 " "
 #else
 #define DEF_TLS_EECDH_AUTO_2 ""
 #endif
+
 #if defined(SN_X9_62_prime256v1) && defined(NID_X9_62_prime256v1)
 #define DEF_TLS_EECDH_AUTO_3 SN_X9_62_prime256v1 " "
 #else
 #define DEF_TLS_EECDH_AUTO_3 ""
 #endif
+
 #if defined(SN_secp384r1) && defined(NID_secp384r1)
-#define DEF_TLS_EECDH_AUTO_4 SN_secp384r1
+#define DEF_TLS_EECDH_AUTO_4 SN_secp384r1 " "
 #else
 #define DEF_TLS_EECDH_AUTO_4 ""
 #endif
+
 #if defined(SN_secp521r1) && defined(NID_secp521r1)
 #define DEF_TLS_EECDH_AUTO_5 SN_secp521r1 " "
 #else

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 95fbd9bfdf18ee3bc1a8af031bc78aadddef70a6..3acccc6f64272cb218ddc7ccb223b7fc915c524f 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,7 +20,7 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20240923"
+#define MAIL_RELEASE_DATE      "20240924"
 #define MAIL_VERSION_NUMBER    "3.10"
 
 #ifdef SNAPSHOT

diff --git a/postfix/src/tls/tls_dh.c b/postfix/src/tls/tls_dh.c
index 6165b9390099cae9847b2759e172fbe584338112..873c3f6e53d00261b5ebd0f4deed86d161ff4ac9 100644 (file)
--- a/postfix/src/tls/tls_dh.c
+++ b/postfix/src/tls/tls_dh.c
@@ -333,8 +333,8 @@ static int setup_auto_groups(SSL_CTX *ctx, const char *origin,
     /*
      * OpenSSL does not tolerate duplicate groups in the requested list.
      * Deduplicate case-insensitively, just in case OpenSSL some day supports
-     * case-insensitive group lookup.  Users who specify the group name twice
-     * and get the case wrong the first time deserve to be unhappy. :-)
+     * case-insensitive group lookup.  Deduplicate only verified extant groups
+     * we're going to ask OpenSSL to use.
      *
      * OpenSSL 3.3 supports "?<name>" as a syntax for optionally ignoring
      * unsupported groups, so we could skip checking against the throw-away
@@ -358,8 +358,6 @@ static int setup_auto_groups(SSL_CTX *ctx, const char *origin,
        SETUP_AG_RETURN(AG_STAT_NO_GROUP);
     }
     for (; group != 0; group = mystrtok(&groups, GROUPS_SEP)) {
-       if (been_here_fixed(seen, group))
-           continue;
        /*
         * Validate the group name by trying it as the group for a throw-away
         * SSL context. This way, we can ask for new groups that may not yet be
@@ -367,7 +365,8 @@ static int setup_auto_groups(SSL_CTX *ctx, const char *origin,
         * silently ignored.
         */
        ERR_set_mark();
-       if (SSL_CTX_set1_curves_list(tmpctx, group) > 0) {
+       if (SSL_CTX_set1_curves_list(tmpctx, group) > 0 &&
+           !been_here_fixed(seen, group)) {
            if (VSTRING_LEN(names) > 0)
                VSTRING_ADDCH(names, ':');
            vstring_strcat(names, group);