postfix-2.8-20100615

diff --git a/postfix/HISTORY b/postfix/HISTORY
index fd45ffe075c6fc527d2f364c774f46968b837311..9b544b285cb3485d6b3b7ff90b5237cd4947f7fd 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -15823,11 +15823,12 @@ Apologies for any names omitted.
 
 20100610
 
-       Postfix no longer appends the system default CAs to the
-       lists specified with *_tls_CAfile or with *_tls_CApath.
+       Bugfix: Postfix no longer appends the system default CAs
+       to the lists specified with *_tls_CAfile or with *_tls_CApath.
        This prevents third-party certificates from being trusted
-       and being given mail relay permission with
-       permit_tls_all_clientcerts.  To get the old behavior specify
+       and given mail relay permission with permit_tls_all_clientcerts.
+       This change may break valid configurations that do not use
+       permit_tls_all_clientcerts.  To get the old behavior, specify
        "tls_append_default_CA = yes".  Files: tls/tls_certkey.c,
        tls/tls_misc.c, global/mail_params.h.  proto/postconf.proto,
        mantools/postlink.

diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES
index b0c82af36f50d1d6c0b647dcde3b28ea2710e0ae..76830b67cbe64d517b201612aab15b4dac334882 100644 (file)
--- a/postfix/RELEASE_NOTES
+++ b/postfix/RELEASE_NOTES
@@ -19,10 +19,12 @@ Incompatibility with snapshot 20100610
 
 Postfix no longer appends the system-supplied default CAs to the
 lists specified with *_tls_CAfile or with *_tls_CApath. This prevents
-third-party certificates from being trusted and being given mail
-relay permission with permit_tls_all_clientcerts.
+third-party certificates from being trusted and given mail relay
+permission with permit_tls_all_clientcerts.
 
-Specify "tls_append_default_CA = yes" for the old behavior.
+Unfortunately this change may break certificate verification on
+sites that don't use permit_tls_all_clientcerts.  Specify
+"tls_append_default_CA = yes" for backwards compatibility.
 
 Incompatibility with snapshot 20100101
 ======================================

diff --git a/postfix/WISHLIST b/postfix/WISHLIST
index 83ae665564f3a88727d05dbb09af5d5608fd05b5..2852219912e0847e268986b124e19e1ad3ef1430 100644 (file)
--- a/postfix/WISHLIST
+++ b/postfix/WISHLIST
@@ -2,6 +2,9 @@ Wish list:
 
        Remove this file from the stable release.
 
+       Need a regular expression table to translate address
+       verification responses into hard/soft/accept reply codes.
+
        When an alias is a member of an :include: list with owner-
        alias, local(8) needs an option to deliver alias or alias->user
        indirectly. What happens when an :include: list with owner-

diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html
index 365fed1320970d307a9b4a7b3f4416ab1225d316..991478f6855cc977ba109139bb93f11e2979c74a 100644 (file)
--- a/postfix/html/postconf.5.html
+++ b/postfix/html/postconf.5.html
@@ -9461,7 +9461,7 @@ $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>. </p>
 
 <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
 appending the system-supplied default CAs and trusting third-party
-certificates. This setting is default as of Postfix 2.8. </p>
+certificates. </p>
 
 <p> Example: </p>
 
@@ -9488,7 +9488,7 @@ must be inside the chroot jail. </p>
 
 <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
 appending the system-supplied default CAs and trusting third-party
-certificates. This setting is default as of Postfix 2.8. </p>
+certificates. </p>
 
 <p> Example: </p>
 
@@ -11141,10 +11141,11 @@ authenticated via the <a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>
 <dd> Permit the request when the remote SMTP client certificate is
 verified successfully.  This option must be used only if a special
 CA issues the certificates and only this CA is listed as trusted
-CA. This requires that "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" (the default
-with Postfix 2.8 and later).  Otherwise, clients with a third-party
-certificate would also be allowed to relay. This feature is available
-with Postfix version 2.2.</dd>
+CA. Otherwise, clients with a third-party certificate would also
+be allowed to relay.  Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" when the
+trusted CA is specified with <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> or <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>,
+to prevent Postfix from appending the system-supplied default CAs.
+This feature is available with Postfix version 2.2.</dd>
 
 <dt><b><a name="permit_tls_clientcerts">permit_tls_clientcerts</a></b></dt>
 
@@ -12959,7 +12960,7 @@ server certificate file. </p>
 
 <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
 appending the system-supplied default CAs and trusting third-party
-certificates. This setting is default as of Postfix 2.8. </p>
+certificates. </p>
 
 <p> By default (see <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>), client certificates are not
 requested, and <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> should remain empty. If you do make use
@@ -12994,7 +12995,7 @@ inside the chroot jail. </p>
 
 <p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
 appending the system-supplied default CAs and trusting third-party
-certificates. This setting is default as of Postfix 2.8. </p>
+certificates. </p>
 
 <p> By default (see <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>), client certificates are
 not requested, and <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> should remain empty. In contrast
@@ -14114,14 +14115,14 @@ connections.  Next, you enable Postfix TCP servers with the updated
 
 <p> Append the system-supplied default certificate authority
 certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
-</p>
-
-<p> To avoid massive compatibility breaks, this parameter defaults
-to "yes" for Postfix versions 2.7 and earlier. That is, they trust
-third-party certificates and they give relay permission with
+The default is "no"; this prevents Postfix from trusting third-party
+certificates and giving them relay permission with
 <a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a>.  </p>
 
-<p> This feature is retroactive in Postfix 2.4 and later. </p>
+<p> This feature is available in Postfix 2.4.15, 2.6.8, 2.7.2 and
+later versions. Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = yes" for backwards
+compatibility, to avoid breaking certificate verification with sites
+that don't use <a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a>. </p>
 
 
 </DD>

diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5
index 592ecfa47a05e286c6f8576cff9a47663dd8ce89..24850ce39a4cb750d3a1d9ed8abf55bb7e5c6903 100644 (file)
--- a/postfix/man/man5/postconf.5
+++ b/postfix/man/man5/postconf.5
@@ -5414,7 +5414,7 @@ $smtp_tls_cert_file.
 .PP
 Specify "tls_append_default_CA = no" to prevent Postfix from
 appending the system-supplied default CAs and trusting third-party
-certificates. This setting is default as of Postfix 2.8.
+certificates.
 .PP
 Example:
 .PP
@@ -5438,7 +5438,7 @@ must be inside the chroot jail.
 .PP
 Specify "tls_append_default_CA = no" to prevent Postfix from
 appending the system-supplied default CAs and trusting third-party
-certificates. This setting is default as of Postfix 2.8.
+certificates.
 .PP
 Example:
 .PP
@@ -6803,10 +6803,11 @@ authenticated via the RFC 4954 (AUTH) protocol.
 Permit the request when the remote SMTP client certificate is
 verified successfully.  This option must be used only if a special
 CA issues the certificates and only this CA is listed as trusted
-CA. This requires that "tls_append_default_CA = no" (the default
-with Postfix 2.8 and later).  Otherwise, clients with a third-party
-certificate would also be allowed to relay. This feature is available
-with Postfix version 2.2.
+CA. Otherwise, clients with a third-party certificate would also
+be allowed to relay.  Specify "tls_append_default_CA = no" when the
+trusted CA is specified with smtpd_tls_CAfile or smtpd_tls_CApath,
+to prevent Postfix from appending the system-supplied default CAs.
+This feature is available with Postfix version 2.2.
 .IP "\fBpermit_tls_clientcerts\fR"
 Permit the request when the remote SMTP client certificate
 fingerprint is listed in $relay_clientcerts.
@@ -8051,7 +8052,7 @@ server certificate file.
 .PP
 Specify "tls_append_default_CA = no" to prevent Postfix from
 appending the system-supplied default CAs and trusting third-party
-certificates. This setting is default as of Postfix 2.8.
+certificates.
 .PP
 By default (see smtpd_tls_ask_ccert), client certificates are not
 requested, and smtpd_tls_CAfile should remain empty. If you do make use
@@ -8084,7 +8085,7 @@ inside the chroot jail.
 .PP
 Specify "tls_append_default_CA = no" to prevent Postfix from
 appending the system-supplied default CAs and trusting third-party
-certificates. This setting is default as of Postfix 2.8.
+certificates.
 .PP
 By default (see smtpd_tls_ask_ccert), client certificates are
 not requested, and smtpd_tls_CApath should remain empty. In contrast
@@ -8943,13 +8944,14 @@ This feature is available in Postfix 2.6 and later.
 .SH tls_append_default_CA (default: no)
 Append the system-supplied default certificate authority
 certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
-.PP
-To avoid massive compatibility breaks, this parameter defaults
-to "yes" for Postfix versions 2.7 and earlier. That is, they trust
-third-party certificates and they give relay permission with
+The default is "no"; this prevents Postfix from trusting third-party
+certificates and giving them relay permission with
 permit_tls_all_clientcerts.
 .PP
-This feature is retroactive in Postfix 2.4 and later.
+This feature is available in Postfix 2.4.15, 2.6.8, 2.7.2 and
+later versions. Specify "tls_append_default_CA = yes" for backwards
+compatibility, to avoid breaking certificate verification with sites
+that don't use permit_tls_all_clientcerts.
 .SH tls_daemon_random_bytes (default: 32)
 The number of pseudo-random bytes that an \fBsmtp\fR(8) or \fBsmtpd\fR(8)
 process requests from the \fBtlsmgr\fR(8) server in order to seed its

diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto
index 574ee1ebd2d6a3e2585f1846689b34ce8a827c1e..e413503410d0d45e179c5d6f6334b9dd8695af42 100644 (file)
--- a/postfix/proto/postconf.proto
+++ b/postfix/proto/postconf.proto
@@ -4860,10 +4860,11 @@ authenticated via the RFC 4954 (AUTH) protocol. </dd>
 <dd> Permit the request when the remote SMTP client certificate is
 verified successfully.  This option must be used only if a special
 CA issues the certificates and only this CA is listed as trusted
-CA. This requires that "tls_append_default_CA = no" (the default
-with Postfix 2.8 and later).  Otherwise, clients with a third-party
-certificate would also be allowed to relay. This feature is available
-with Postfix version 2.2.</dd>
+CA. Otherwise, clients with a third-party certificate would also
+be allowed to relay.  Specify "tls_append_default_CA = no" when the
+trusted CA is specified with smtpd_tls_CAfile or smtpd_tls_CApath,
+to prevent Postfix from appending the system-supplied default CAs.
+This feature is available with Postfix version 2.2.</dd>
 
 <dt><b><a name="permit_tls_clientcerts">permit_tls_clientcerts</a></b></dt>
 
@@ -8678,7 +8679,7 @@ server certificate file. </p>
 
 <p> Specify "tls_append_default_CA = no" to prevent Postfix from
 appending the system-supplied default CAs and trusting third-party
-certificates. This setting is default as of Postfix 2.8. </p>
+certificates. </p>
 
 <p> By default (see smtpd_tls_ask_ccert), client certificates are not
 requested, and smtpd_tls_CAfile should remain empty. If you do make use
@@ -8709,7 +8710,7 @@ inside the chroot jail. </p>
 
 <p> Specify "tls_append_default_CA = no" to prevent Postfix from
 appending the system-supplied default CAs and trusting third-party
-certificates. This setting is default as of Postfix 2.8. </p>
+certificates. </p>
 
 <p> By default (see smtpd_tls_ask_ccert), client certificates are
 not requested, and smtpd_tls_CApath should remain empty. In contrast
@@ -9081,7 +9082,7 @@ $smtp_tls_cert_file. </p>
 
 <p> Specify "tls_append_default_CA = no" to prevent Postfix from
 appending the system-supplied default CAs and trusting third-party
-certificates. This setting is default as of Postfix 2.8. </p>
+certificates. </p>
 
 <p> Example: </p>
 
@@ -9104,7 +9105,7 @@ must be inside the chroot jail. </p>
 
 <p> Specify "tls_append_default_CA = no" to prevent Postfix from
 appending the system-supplied default CAs and trusting third-party
-certificates. This setting is default as of Postfix 2.8. </p>
+certificates. </p>
 
 <p> Example: </p>
 
@@ -9399,14 +9400,14 @@ smtp_tls_dcert_file = /etc/postfix/client-dsa.pem
 
 <p> Append the system-supplied default certificate authority
 certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
-</p>
-
-<p> To avoid massive compatibility breaks, this parameter defaults
-to "yes" for Postfix versions 2.7 and earlier. That is, they trust
-third-party certificates and they give relay permission with
+The default is "no"; this prevents Postfix from trusting third-party
+certificates and giving them relay permission with
 permit_tls_all_clientcerts.  </p>
 
-<p> This feature is retroactive in Postfix 2.4 and later. </p>
+<p> This feature is available in Postfix 2.4.15, 2.6.8, 2.7.2 and
+later versions. Specify "tls_append_default_CA = yes" for backwards
+compatibility, to avoid breaking certificate verification with sites
+that don't use permit_tls_all_clientcerts. </p>
 
 %PARAM tls_random_exchange_name see "postconf -d" output
 

diff --git a/postfix/src/global/mail_params.h b/postfix/src/global/mail_params.h
index 1d4be1e9928e04789aee5d24dfb956d524856c42..7afd598dbb97716b2e65f89fbaebb3c93a6e9697 100644 (file)
--- a/postfix/src/global/mail_params.h
+++ b/postfix/src/global/mail_params.h
@@ -624,7 +624,7 @@ extern bool var_stat_home_dir;
 extern int var_dup_filter_limit;
 
 #define VAR_TLS_APPEND_DEF_CA  "tls_append_default_CA"
-#define DEF_TLS_APPEND_DEF_CA  0       /* 1 for Postfix < 2.8 */
+#define DEF_TLS_APPEND_DEF_CA  0       /* Postfix < 2.8 BC break */
 extern bool var_tls_append_def_CA;
 
 #define VAR_TLS_RAND_EXCH_NAME "tls_random_exchange_name"

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index f2bfc7139278983a0d05d71483095816ad75ae78..9d1233f29950b8e91abd972eef37c86b4848c438 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,7 +20,7 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20100610"
+#define MAIL_RELEASE_DATE      "20100615"
 #define MAIL_VERSION_NUMBER    "2.8"
 
 #ifdef SNAPSHOT