Bugfix: segfault in the tlsproxy client role when the server
role was disabled. This typically happens with a first-time
Postfix install and after configuring only outbound TLS.
- File: tlsproxy/tlsproxy.c.
+ Found during program maintenance. File: tlsproxy/tlsproxy.c.
+
+20200420
+
+ Noise suppression: shut up a compiler that special-cases
+ string literals. File milter/milter.c.
+
+20200422
+
+ Security: disable TLSA/DANE on Alpine Linux because libc-musl
+ provides no indication whether responses are authentic.
+ This broke TLSA/DANE without a clear explanation. File:
+ makedefs.
+
+20200425
+
+ Robustness: enable the socket option SO_REUSEPORT_LB or
+ SO_REUSEPORT on systems that support it. It allows multiple
+ processes to create distinct listen sockets for the same
+ address and port, and makes Postfix easier to restart.
+ However, with a SHARED listen socket as used in Postfix,
+ kernel-based load balancing does not help, and Postfix still
+ requires locking to avoid waking up multiple processes when
+ a connection arrives. Files: util/inet_listen.c,
+
+20200502
+
+ Documentation: update SNI support status in TLS_README.
+ File: proto/TLS_READNE.html.
+
+20200503
- Portability: libc-musl breaks TLSA/DANE. Force the user to
- override a test and accept that Postfix will not support
- TLSA/DANE. File: makedefs.
+ Portability: declaration should be before executable
+ statement. File: util/msg_logger.c.
The above client pre-requisites do not apply to the Postfix SMTP server. It
will support DANE provided it supports TLSv1 and its TLSA records are published
in a DNSSEC signed zone. To receive DANE secured mail for multiple domains, use
-the same hostname to add the server to each domain's MX records. There are no
-plans to implement SNI in the Postfix SMTP server.
+the same hostname to add the server to each domain's MX records. The Postfix
+SMTP server supports SNI (Postfix 3.4 and later), configured with
+tls_server_sni_maps.
Note: The Postfix SMTP client's internal stub DNS resolver is DNSSEC-aware, but
it does not itself validate DNSSEC records, rather it delegates DNSSEC
Wish list:
+ Find a reasonable way to generate postconf configuration
+ parameter tables without breaking gcc -fnocommon.
+
Read http://mmogilvi.users.sourceforge.net/software/oauthbearer.html
and see how we can improve on the Postfix side.
- Investigate feasibility of SO_REUSEPORT (~portable) and
- SO_REUSEPORT_LB (*BSD).
-
nbbio: exercise the sanity checks with fake msg(3) functions.
optreset (bsd-ism) how badly do we need it?
It will support DANE provided it supports TLSv1 and its TLSA records are
published in a DNSSEC signed zone. To receive DANE secured mail for multiple
domains, use the same hostname to add the server to each domain's MX
-records. There are no plans to implement SNI in the Postfix SMTP server. </p>
+records. The Postfix SMTP server supports SNI (Postfix 3.4 and later),
+configured with <a href="postconf.5.html#tls_server_sni_maps">tls_server_sni_maps</a>. </p>
<p> Note: The Postfix SMTP client's internal stub DNS resolver is
DNSSEC-aware, but it does not itself validate DNSSEC records, rather
# No ${x%%y} support in Solaris 11 /bin/sh
RELEASE_MAJOR=`expr "$RELEASE" : '\([0-9]*\)'` || exit 1
VERSION=`(uname -v) 2>/dev/null`
- case "$SYSTEM.$VERSION" in
- Linux.#[0-9]*-Alpine*)
- case "$CCARGS" in
- *-DNO_DNSSEC*) ;;
- *) echo Warning: libc-musl breaks DANE/TLSA security. 1>&2
- echo Use a glibc-based Linux distribution, or build 1>&2
- echo with: 'make makefiles CCARGS="-DNO_DNSSEC ..."'. 1>&2
- exit 1;;
- esac;
- esac
case "$VERSION" in
dcosx*) SYSTEM=$VERSION;;
esac;;
# Unsupported debug-only mode. Not suitable for cross-platform tests.
- 2) SYSTEM="$1"; RELEASE="$2";;
- *) echo usage: $0 [system release] 1>&2; exit 1;;
+2|3) SYSTEM="$1"; RELEASE="$2"; VERSION="$3";;
+ *) echo usage: $0 [system release version] 1>&2; exit 1;;
+esac
+
+case "$SYSTEM.$VERSION" in
+ Linux.#*-Alpine*)
+ case "$CCARGS" in
+ *-DNO_DNSSEC*) ;;
+ *) echo Warning: libc-musl breaks DANE/TLSA security. 1>&2
+ echo This build will not support DANE/TLSA. 1>&2
+ CCARGS="$CCARGS -DNO_DNSSEC";;
+ esac;;
esac
case "$SYSTEM.$RELEASE" in
It will support DANE provided it supports TLSv1 and its TLSA records are
published in a DNSSEC signed zone. To receive DANE secured mail for multiple
domains, use the same hostname to add the server to each domain's MX
-records. There are no plans to implement SNI in the Postfix SMTP server. </p>
+records. The Postfix SMTP server supports SNI (Postfix 3.4 and later),
+configured with tls_server_sni_maps. </p>
<p> Note: The Postfix SMTP client's internal stub DNS resolver is
DNSSEC-aware, but it does not itself validate DNSSEC records, rather
* Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only.
*/
-#define MAIL_RELEASE_DATE "20200419"
+#define MAIL_RELEASE_DATE "20200503"
#define MAIL_VERSION_NUMBER "3.6"
#ifdef SNAPSHOT
* names by skipping the redundant "milter_" prefix.
*/
static ATTR_OVER_TIME time_table[] = {
- 7 + VAR_MILT_CONN_TIME, DEF_MILT_CONN_TIME, 0, 1, 0,
- 7 + VAR_MILT_CMD_TIME, DEF_MILT_CMD_TIME, 0, 1, 0,
- 7 + VAR_MILT_MSG_TIME, DEF_MILT_MSG_TIME, 0, 1, 0,
+ 7 + (const char *) VAR_MILT_CONN_TIME, DEF_MILT_CONN_TIME, 0, 1, 0,
+ 7 + (const char *) VAR_MILT_CMD_TIME, DEF_MILT_CMD_TIME, 0, 1, 0,
+ 7 + (const char *) VAR_MILT_MSG_TIME, DEF_MILT_MSG_TIME, 0, 1, 0,
0,
};
static ATTR_OVER_STR str_table[] = {
- 7 + VAR_MILT_PROTOCOL, 0, 1, 0,
- 7 + VAR_MILT_DEF_ACTION, 0, 1, 0,
+ 7 + (const char *) VAR_MILT_PROTOCOL, 0, 1, 0,
+ 7 + (const char *) VAR_MILT_DEF_ACTION, 0, 1, 0,
0,
};
if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR,
(void *) &on, sizeof(on)) < 0)
msg_fatal("setsockopt(SO_REUSEADDR): %m");
+#if defined(SO_REUSEPORT_LB)
+ if (setsockopt(sock, SOL_SOCKET, SO_REUSEPORT_LB,
+ (void *) &on, sizeof(on)) < 0)
+ msg_fatal("setsockopt(SO_REUSEPORT_LB): %m");
+#elif defined(SO_REUSEPORT)
+ if (setsockopt(sock, SOL_SOCKET, SO_REUSEPORT,
+ (void *) &on, sizeof(on)) < 0)
+ msg_fatal("setsockopt(SO_REUSEPORT): %m");
+#endif
if (bind(sock, res->ai_addr, res->ai_addrlen) < 0) {
SOCKADDR_TO_HOSTADDR(res->ai_addr, res->ai_addrlen,
&hostaddr, &portnum, 0);
struct tm *lt;
ssize_t len;
- /*
- * This test is simple enough that we don't bother with unregistering the
- * msg_logger_print() function.
- */
- if (msg_logger_enable == 0)
- return;
-
/*
* TODO: this should be a reusable NAME_CODE table plus lookup function.
*/
"info", "warning", "error", "fatal", "panic",
};
+ /*
+ * This test is simple enough that we don't bother with unregistering the
+ * msg_logger_print() function.
+ */
+ if (msg_logger_enable == 0)
+ return;
+
/*
* Note: there is code in postlogd(8) that attempts to strip off
* information that is prepended here. If the formatting below is
projects / thirdparty / postfix.git / commitdiff
