postfix-3.5.6

diff --git a/postfix/HISTORY b/postfix/HISTORY
index 55ea702fa31512e7e097bbc0b546de9187efe366..e0cdef2605fe28abd7cb5c224532e29dc81e6c99 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -24809,3 +24809,13 @@ Apologies for any names omitted.
        settings in a system-wide OpenSSL configuration file, causing
        interoperability problems after an OS update. File:
        tls/tls_client.c, tls/tls_server.c.
+
+20200726
+
+       Bugfix (introduced: Postfix 3.5.5): part of a memory leak
+       fix was backported to the wrong place. File: tls/tls_misc.c.
+
+       The Postfix 3.5.5 workaround did not explicitly override
+       the system-wide OpenSSL configuration of allowed TLS protocol
+       versions, for sessions where the remote SMTP client sends
+       SNI. It's better to be safe than sorry. File: tls/tls_server.c.

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index d266de25ad77f2c82c50d6f802e8d0dcf20ccbd5..4feb5a3175fbadcb150669cb7293036f2a5d9e40 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20200724"
-#define MAIL_VERSION_NUMBER    "3.5.5"
+#define MAIL_RELEASE_DATE      "20200726"
+#define MAIL_VERSION_NUMBER    "3.5.6"
 
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE      "-" MAIL_RELEASE_DATE

diff --git a/postfix/src/tls/tls_misc.c b/postfix/src/tls/tls_misc.c
index 94e356b4766b8742f2cea4e228dfabf3ef1bac63..970d9c36efa2dfd25dc90c3bfd777c5ebd0b179e 100644 (file)
--- a/postfix/src/tls/tls_misc.c
+++ b/postfix/src/tls/tls_misc.c
@@ -922,8 +922,6 @@ void    tls_get_signature_params(TLS_SESS_STATE *TLScontext)
         */
        if (SSL_get_signature_nid(ssl, &nid) && nid != NID_undef)
            locl_sig_dgst = OBJ_nid2sn(nid);
-
-       X509_free(cert);
     }
     /* Signature algorithms for the peer end of the connection */
     if ((cert = SSL_get_peer_certificate(ssl)) != 0) {
@@ -965,6 +963,8 @@ void    tls_get_signature_params(TLS_SESS_STATE *TLScontext)
         */
        if (SSL_get_peer_signature_nid(ssl, &nid) && nid != NID_undef)
            peer_sig_dgst = OBJ_nid2sn(nid);
+
+       X509_free(cert);
     }
     if (kex_name) {
        TLScontext->kex_name = mystrdup(kex_name);

diff --git a/postfix/src/tls/tls_server.c b/postfix/src/tls/tls_server.c
index 6d709c8bf9ff73e41e198ac877b72efe91585381..25d85ec7bcf9682c74088a2a0294743fa428df25 100644 (file)
--- a/postfix/src/tls/tls_server.c
+++ b/postfix/src/tls/tls_server.c
@@ -530,6 +530,7 @@ TLS_APPL_STATE *tls_server_init(const TLS_SERVER_INIT_PROPS *props)
     /* Enable all supported protocols */
 #if OPENSSL_VERSION_NUMBER >= 0x1010000fUL
     SSL_CTX_set_min_proto_version(server_ctx, 0);
+    SSL_CTX_set_min_proto_version(sni_ctx, 0);
 #endif
 
     /*