postfix-3.12-20260510

diff --git a/postfix/HISTORY b/postfix/HISTORY
index aea6e426ede841142599d6a3ad2ef6ac6cf080d1..53a20f71893e9f8b74cd3078334f096f6f7428b1 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -31086,14 +31086,14 @@ Apologies for any names omitted.
        Tech debt: restructured initialization of $service_name.
        Also enforced that Postfix daemons ignore $process_name and
        $service_name parameter settings in main.cf or master.cf
-       (parameters are read-only). Files: master/dgram_server.c,
-       master/event_server.c, master/multi_server.c,
-       master/single_server.c, master/trigger_server.c,
-       postconf/postconf_builtin.c.
+       (parameters are read-only). Files: global/mail_params.c,
+       master/dgram_server.c, master/event_server.c,
+       master/multi_server.c, master/single_server.c,
+       master/trigger_server.c, postconf/postconf_builtin.c.
 
 20260508
 
-       Claude AI findings, bought to our attention by Robert Sayre.
+       Claude AI findings, brought to our attention by Robert Sayre.
        Deleted an obsolete __MAXINT__ definition (util/timecmp.c);
        fixed a signed integer overshift operation (util/vstring.h).
 
@@ -31103,6 +31103,22 @@ Apologies for any names omitted.
        Files: proto/PTEST_README.html, ptest/ptest_log.c,
        ptest/ptest_log_test.c, ptest/ptest_run.c.
 
+20260509
+
+       Bitrot fixes: deprecation warning with OpenSSL 4.0
+       (tls/tls_dane.c); race condition fix in a test script
+       (tls/dls_dane.sh). Viktor Dukhovni.
+
+20260510
+
+       Bugfix (defect introduced: 20260507): unterminated comment
+       caused missing initializations, crashing postscreen with a
+       null pointer while handling a STARTTLS request. Report by
+       Florian Piekert, fix by Viktor Dukhovni with Claude AI.
+       Files: master/dgram_server.c, master/event_server.c,
+       master/multi_server.c, master/single_server.c,
+       src/master/trigger_server.c.
+
 TODO
 
        Reorganize PTEST_LIB, PMOCK_LIB, TESTLIB, TESTLIBS, etc.

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 4b2c242ca1c8149a41818a026bc5cd6b38e39762..96e4ad8b9362f6f2d819a848bb9dd14344f7f7f6 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,7 +20,7 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20260508"
+#define MAIL_RELEASE_DATE      "20260510"
 #define MAIL_VERSION_NUMBER    "3.12"
 
 #ifdef SNAPSHOT

diff --git a/postfix/src/master/dgram_server.c b/postfix/src/master/dgram_server.c
index 426fc7cd9720ddd631c4c3f989c4d9f3388d9691..7400a7e5fd514471d0f50fcf72442518cb1a1f71 100644 (file)
--- a/postfix/src/master/dgram_server.c
+++ b/postfix/src/master/dgram_server.c
@@ -446,9 +446,9 @@ NORETURN dgram_server_main(int argc, char **argv, DGRAM_SERVER_FN service,...)
            break;
        }
     }
-    /* Read-only parameters must not be changed with '-o name=value'.
+    /* Read-only parameters must not be changed with '-o name=value'. */
     set_mail_conf_str(VAR_PROCNAME, var_procname);
-    var_servname = mystrdup(servname);
+    var_servname = mystrdup(service_name);
     set_mail_conf_str(VAR_SERVNAME, var_servname);
 
     /*

diff --git a/postfix/src/master/event_server.c b/postfix/src/master/event_server.c
index f70f124a49e51b6b8bed79a2203c9785823bdcbd..8893430e946831a3bcf0cfa5b4235fbfd1e5db3d 100644 (file)
--- a/postfix/src/master/event_server.c
+++ b/postfix/src/master/event_server.c
@@ -725,9 +725,9 @@ NORETURN event_server_main(int argc, char **argv, MULTI_SERVER_FN service,...)
            break;
        }
     }
-    /* Read-only parameters must not be changed with '-o name=value'.
+    /* Read-only parameters must not be changed with '-o name=value'. */
     set_mail_conf_str(VAR_PROCNAME, var_procname);
-    var_servname = mystrdup(servname);
+    var_servname = mystrdup(service_name);
     set_mail_conf_str(VAR_SERVNAME, var_servname);
 
     /*

diff --git a/postfix/src/master/multi_server.c b/postfix/src/master/multi_server.c
index 33f0012e0517f2f72cf9d6e52306052df27a660a..55255e125cf7fc9a6daa2a74bc4801effb217e64 100644 (file)
--- a/postfix/src/master/multi_server.c
+++ b/postfix/src/master/multi_server.c
@@ -703,9 +703,9 @@ NORETURN multi_server_main(int argc, char **argv, MULTI_SERVER_FN service,...)
            break;
        }
     }
-    /* Read-only parameters must not be changed with '-o name=value'.
+    /* Read-only parameters must not be changed with '-o name=value'. */
     set_mail_conf_str(VAR_PROCNAME, var_procname);
-    var_servname = mystrdup(servname);
+    var_servname = mystrdup(service_name);
     set_mail_conf_str(VAR_SERVNAME, var_servname);
 
     /*

diff --git a/postfix/src/master/single_server.c b/postfix/src/master/single_server.c
index 4c4559f6059d0705db9abd1071be0afa5d9fd341..de859f6e4d14dfa6428194d8d80f28d20fd9da69 100644 (file)
--- a/postfix/src/master/single_server.c
+++ b/postfix/src/master/single_server.c
@@ -577,9 +577,9 @@ NORETURN single_server_main(int argc, char **argv, SINGLE_SERVER_FN service,...)
            break;
        }
     }
-    /* Read-only parameters must not be changed with '-o name=value'.
+    /* Read-only parameters must not be changed with '-o name=value'. */
     set_mail_conf_str(VAR_PROCNAME, var_procname);
-    var_servname = mystrdup(servname);
+    var_servname = mystrdup(service_name);
     set_mail_conf_str(VAR_SERVNAME, var_servname);
 
     /*

diff --git a/postfix/src/master/trigger_server.c b/postfix/src/master/trigger_server.c
index 4aca681f4d952fa6c0b16182fbfe1158c3619546..88f084ee173ba92e758e6d4588d2103b4af7b298 100644 (file)
--- a/postfix/src/master/trigger_server.c
+++ b/postfix/src/master/trigger_server.c
@@ -559,9 +559,9 @@ NORETURN trigger_server_main(int argc, char **argv, TRIGGER_SERVER_FN service,..
            break;
        }
     }
-    /* Read-only parameters must not be changed with '-o name=value'.
+    /* Read-only parameters must not be changed with '-o name=value'. */
     set_mail_conf_str(VAR_PROCNAME, var_procname);
-    var_servname = mystrdup(servname);
+    var_servname = mystrdup(service_name);
     set_mail_conf_str(VAR_SERVNAME, var_servname);
 
     /*

diff --git a/postfix/src/tls/tls_dane.c b/postfix/src/tls/tls_dane.c
index ffeb87fc7af4595589d042f95af0e2c1984d6147..5533b7b712eb138b1e95f67ba2f153406a1b224e 100644 (file)
--- a/postfix/src/tls/tls_dane.c
+++ b/postfix/src/tls/tls_dane.c
@@ -1356,7 +1356,7 @@ int     main(int argc, char *argv[])
     SSL_dane_set_flags(tctx->con, DANE_FLAG_NO_DANE_EE_NAMECHECKS);
     SSL_dane_set_flags(tctx->con, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
     for (i = 7; i < argc; ++i)
-       if (!SSL_add1_host(tctx->con, argv[i]))
+       if (!TLS_ADD1_HOST(tctx->con, argv[i]))
            msg_fatal("error adding hostname: %s", argv[i]);
     load_tlsa_args(tctx->con, argv);
     SSL_set_connect_state(tctx->con);

diff --git a/postfix/src/tls/tls_dane.sh b/postfix/src/tls/tls_dane.sh
index ac7b8a228cd31a991b7a66e101da7330f6378b6a..9440b3fbc37083e3050934a06f5eb72ee86a1073 100644 (file)
--- a/postfix/src/tls/tls_dane.sh
+++ b/postfix/src/tls/tls_dane.sh
@@ -51,6 +51,7 @@ genroot() {
     local akid=$1; shift
 
     exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid" "basicConstraints = CA:true")
+    key "$key"
     req "$key" "$cn" |
        cert "$cert" "$exts" -signkey "${key}.pem" -set_serial 1 -days 30
 }
@@ -65,6 +66,7 @@ genca() {
     local cakey=$1; shift
 
     exts=$(printf "%s\n%s\n%s\n" "$skid" "$akid" "basicConstraints = CA:true")
+    key "$key"
     req "$key" "$cn" |
        cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
            -set_serial 2 -days 30 "$@"
@@ -83,6 +85,7 @@ genee() {
            "basicConstraints = CA:false" \
            "extendedKeyUsage = serverAuth" \
            "subjectAltName = @alts" "DNS=${cn}")
+    key "$key"
     req "$key" "$cn" |
        cert "$cert" "$exts" -CA "${ca}.pem" -CAkey "${cakey}.pem" \
            -set_serial 2 -days 30 "$@"
@@ -99,6 +102,7 @@ genss() {
            "basicConstraints = CA:true" \
            "extendedKeyUsage = serverAuth" \
            "subjectAltName = @alts" "DNS=${cn}")
+    key "$key"
     req "$key" "$cn" |
        cert "$cert" "$exts" -set_serial 1 -days 30 -signkey "${key}.pem" "$@"
 }
@@ -107,8 +111,9 @@ gennocn() {
     local key=$1; shift
     local cert=$1; shift
 
+    key "$key"
     req_nocn "$key" |
-       cert "$cert" "" -signkey "${key}.pem" -set_serial 1 -days -1 "$@"
+       cert "$cert" "" -signkey "${key}.pem" -set_serial 1 -days 0 "$@"
 }
 
 runtest() {