postfix-3.2.4

diff --git a/postfix/HISTORY b/postfix/HISTORY
index 53d021af1dc8d1ef69d92a53a0e0a309b4e31510..c3989d08aae10727174cc69fff957b60569c8dd5 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -23004,7 +23004,7 @@ Apologies for any names omitted.
 
        Safety: restore sanity checks for dynamically-specified
        width and precision in format strings (%*, %.*, and %*.*).
-       These checks were lost with the Postfix 3.2.2 rewrite of
+       These checks were lost with the Postfix 3.2 rewrite of
        the vbuf_print formatter. File: vbuf_print.c.
 
 20170923
@@ -23012,5 +23012,19 @@ Apologies for any names omitted.
        Bugfix (introduced: Postfix 3.2): panic in the postqueue
        command after output write error while listing the queue.
        This change restores a write error check that was lost with
-       the Postfix 3.2.2 rewrite of the vbuf_print formatter.
+       the Postfix 3.2 rewrite of the vbuf_print formatter.
        Problem reported by Andreas Schulze. File: util/vbuf_print.c.
+
+20171009
+
+       Bugfix (introduced: Postfix 3.1): DANE support. Postfix
+       builds with OpenSSL 1.0.0 or 1.0.1 failed to send email to
+       some sites with "TLSA 2 X X" records associated with an
+       intermediate CA certificate. Problem report and initial
+       fix by Erwan Legrand. File: src/tls/tls_dane.c.
+
+20171024
+
+       Bugfix (introduced: Postfix 3.0) missing dynamicmaps support
+       in the Postfix sendmail command broke authorized_submit_users
+       with a dynamically-loaded map type. File: sendmail/sendmail.c.

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index e1de974af81b1e5d55244060700b665558c76467..fa7fd32cccf4d0eaf49bca43f9ae934b8c1b2de4 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20170924"
-#define MAIL_VERSION_NUMBER    "3.2.3"
+#define MAIL_RELEASE_DATE      "20171028"
+#define MAIL_VERSION_NUMBER    "3.2.4"
 
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE      "-" MAIL_RELEASE_DATE

diff --git a/postfix/src/sendmail/Makefile.in b/postfix/src/sendmail/Makefile.in
index 83fa93bb9f0e4479b652ee13dde8c76d18170cfe..ee023f4345b73597c99f93b38aa8dbf7d679bb47 100644 (file)
--- a/postfix/src/sendmail/Makefile.in
+++ b/postfix/src/sendmail/Makefile.in
@@ -73,6 +73,7 @@ sendmail.o: ../../include/header_opts.h
 sendmail.o: ../../include/htable.h
 sendmail.o: ../../include/iostuff.h
 sendmail.o: ../../include/mail_conf.h
+sendmail.o: ../../include/mail_dict.h
 sendmail.o: ../../include/mail_flush.h
 sendmail.o: ../../include/mail_params.h
 sendmail.o: ../../include/mail_parm_split.h

diff --git a/postfix/src/sendmail/sendmail.c b/postfix/src/sendmail/sendmail.c
index d63caaf60e44a4a3d094d12feab5fdd5a3cdeec9..340281bc98504f2e9187ac284f9f1c190644b10b 100644 (file)
--- a/postfix/src/sendmail/sendmail.c
+++ b/postfix/src/sendmail/sendmail.c
@@ -495,6 +495,7 @@
 #include <deliver_request.h>
 #include <mime_state.h>
 #include <header_opts.h>
+#include <mail_dict.h>
 #include <user_acl.h>
 #include <dsn_mask.h>
 #include <mail_parm_split.h>
@@ -1114,6 +1115,8 @@ int     main(int argc, char **argv)
     msg_syslog_init(mail_task("sendmail"), LOG_PID, LOG_FACILITY);
     get_mail_conf_str_table(str_table);
 
+    mail_dict_init();
+
     if (chdir(var_queue_dir))
        msg_fatal_status(EX_UNAVAILABLE, "chdir %s: %m", var_queue_dir);
 

diff --git a/postfix/src/tls/tls_dane.c b/postfix/src/tls/tls_dane.c
index df4e6854295ee4aebbf31235aeb8ba71bcb2f7c0..8ec61379bebe2e67f799f6acb6580c554ae9370b 100644 (file)
--- a/postfix/src/tls/tls_dane.c
+++ b/postfix/src/tls/tls_dane.c
@@ -1450,7 +1450,7 @@ static X509_NAME *akid_issuer_name(AUTHORITY_KEYID *akid)
 
 /* set_issuer - set issuer DN to match akid if specified */
 
-static int set_issuer_name(X509 *cert, AUTHORITY_KEYID *akid)
+static int set_issuer_name(X509 *cert, AUTHORITY_KEYID *akid, X509_NAME *subj)
 {
     X509_NAME *name = akid_issuer_name(akid);
 
@@ -1460,7 +1460,7 @@ static int set_issuer_name(X509 *cert, AUTHORITY_KEYID *akid)
      */
     if (name)
        return (X509_set_issuer_name(cert, name));
-    return (X509_set_issuer_name(cert, X509_get_subject_name(cert)));
+    return (X509_set_issuer_name(cert, subj));
 }
 
 /* grow_chain - add certificate to trusted or untrusted chain */
@@ -1522,7 +1522,7 @@ static void wrap_key(TLS_SESS_STATE *TLScontext, int depth,
      */
     if (!X509_set_version(cert, 2)
        || !set_serial(cert, akid, subject)
-       || !set_issuer_name(cert, akid)
+       || !set_issuer_name(cert, akid, name)
        || !X509_gmtime_adj(X509_getm_notBefore(cert), -30 * 86400L)
        || !X509_gmtime_adj(X509_getm_notAfter(cert), 30 * 86400L)
        || !X509_set_subject_name(cert, name)
@@ -1798,6 +1798,10 @@ void    tls_dane_set_callback(SSL_CTX *ctx, TLS_SESS_STATE *TLScontext)
 #include <mail_conf.h>
 #include <msg_vstream.h>
 
+#if OPENSSL_VERSION_NUMBER < 0x10002000L
+#define SSL_get0_param(s) ((s)->param)
+#endif
+
 static int verify_chain(SSL *ssl, x509_stack_t *chain, TLS_SESS_STATE *tctx)
 {
     int ret;