postfix-2.7.10

diff --git a/postfix/HISTORY b/postfix/HISTORY
index fdc0f8d69d3b9a1a248a4ba43047dfeb343c213f..85f2a878ffad5fd0334fc1801fb279a3826b327a 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -16041,3 +16041,33 @@ Apologies for any names omitted.
        a patch by Victor Duchovni.  Files: proto/TLS_README.html,
        proto/postconf.proto, tls/tls.h, tls/tls_misc.c, tls/tls_client.c,
        tls/tls_server.c.
+
+20120425
+
+       Workaround: bugs in 10-year old gcc versions break compilation
+       with #ifdef inside a macro invocation (NOT: definition).
+       Files: tls/tls.h, tls/tls_client.c, tls/tls_server.c.
+
+20120517
+
+       Workaround: to avoid crashes when the OpenSSL library is
+       updated without "postfix reload", the Postfix TLS session
+       cache ID now includes the OpenSSL library version number.
+       Note: this problem cannot be fixed in tlsmgr(8). Code by
+       Victor Duchovni. Files: tls/tls_server.c, tls_client.c.
+
+20120520
+
+       Bugfix (introduced Postfix 2.4): the event_drain() function
+       was comparing bitmasks incorrectly causing the program to
+       always wait for the full time limit. This error affected
+       the unused postkick command, but only after s/fifo/unix/
+       in master.cf.  File: util/events.c.
+
+       Cleanup: laptop users have always been able to avoid
+       unnecessary disk spin-up by doing s/fifo/unix/ in master.cf
+       (this is currently not supported on Solaris systems).
+       However, to make this work reliably, the "postqueue -f"
+       command must wait until its requests have reached the pickup
+       and qmgr servers before closing the UNIX-domain request
+       sockets.  Files: postqueue/postqueue.c, postqueue/Makefile.in.

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 89573e00bf17b09fd5636e0177e68b7409c8abd9..7ff0c69343d44a86ba92d8d53995180861885027 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20120424"
-#define MAIL_VERSION_NUMBER    "2.7.9"
+#define MAIL_RELEASE_DATE      "20120520"
+#define MAIL_VERSION_NUMBER    "2.7.10"
 
 #ifdef SNAPSHOT
 # define MAIL_VERSION_DATE     "-" MAIL_RELEASE_DATE

diff --git a/postfix/src/postqueue/Makefile.in b/postfix/src/postqueue/Makefile.in
index 4e80a3c811f70a8f82032cb48cefce178e64ef02..3de971430e063f50f6093c5b4152dfca6b91d6c0 100644 (file)
--- a/postfix/src/postqueue/Makefile.in
+++ b/postfix/src/postqueue/Makefile.in
@@ -61,6 +61,7 @@ postqueue.o: ../../include/argv.h
 postqueue.o: ../../include/attr.h
 postqueue.o: ../../include/clean_env.h
 postqueue.o: ../../include/connect.h
+postqueue.o: ../../include/events.h
 postqueue.o: ../../include/flush_clnt.h
 postqueue.o: ../../include/iostuff.h
 postqueue.o: ../../include/mail_conf.h

diff --git a/postfix/src/postqueue/postqueue.c b/postfix/src/postqueue/postqueue.c
index 4dfedabb7d2a8d59e2524fe404f15a8264bef470..62db4d37dcc9e7374c9e3bf177ce377f70c4b82f 100644 (file)
--- a/postfix/src/postqueue/postqueue.c
+++ b/postfix/src/postqueue/postqueue.c
@@ -186,6 +186,7 @@
 #include <safe.h>
 #include <connect.h>
 #include <valid_hostname.h>
+#include <events.h>
 
 /* Global library. */
 
@@ -351,6 +352,7 @@ static void flush_queue(void)
     if (mail_flush_maildrop() < 0)
        msg_fatal_status(EX_UNAVAILABLE,
                         "Cannot flush mail queue - mail system is down");
+    event_drain(2);
 }
 
 /* flush_site - flush mail for site */

diff --git a/postfix/src/tls/tls.h b/postfix/src/tls/tls.h
index 88e860c8e9eaa729cb9adb791926fa2e049b95ef..aa22cc3c48b2c39e4606bd30f34dfc63a95360da 100644 (file)
--- a/postfix/src/tls/tls.h
+++ b/postfix/src/tls/tls.h
@@ -158,11 +158,15 @@ extern void tls_param_init(void);
 #define TLS_PROTOCOL_TLSv1_1   (1<<3)  /* TLSv1_1 */
 #else
 #define TLS_PROTOCOL_TLSv1_1   0       /* Unknown */
+#undef  SSL_OP_NO_TLSv1_1
+#define SSL_OP_NO_TLSv1_1      0L      /* Noop */
 #endif
 #ifdef SSL_TXT_TLSV1_2
 #define TLS_PROTOCOL_TLSv1_2   (1<<4)  /* TLSv1_2 */
 #else
 #define TLS_PROTOCOL_TLSv1_2   0       /* Unknown */
+#undef  SSL_OP_NO_TLSv1_2
+#define SSL_OP_NO_TLSv1_2      0L      /* Noop */
 #endif
 #define TLS_KNOWN_PROTOCOLS    \
        ( TLS_PROTOCOL_SSLv2 | TLS_PROTOCOL_SSLv3 | TLS_PROTOCOL_TLSv1 \

diff --git a/postfix/src/tls/tls_client.c b/postfix/src/tls/tls_client.c
index afb1597953d33a25e3e1153cd14813a73ea47054..e10ef061a570fd635f5429946aa75c8752a96e65 100644 (file)
--- a/postfix/src/tls/tls_client.c
+++ b/postfix/src/tls/tls_client.c
@@ -782,6 +782,12 @@ TLS_SESS_STATE *tls_client_start(const TLS_CLIENT_START_PROPS *props)
        msg_info("%s: TLS cipher list \"%s\"", props->namaddr, cipher_list);
     vstring_sprintf_append(myserverid, "&c=%s", cipher_list);
 
+    /*
+     * Finally, salt the session key with the OpenSSL library version,
+     * (run-time, rather than compile-time, just in case that matters).
+     */
+    vstring_sprintf_append(myserverid, "&l=%ld", (long) SSLeay());
+
     /*
      * Allocate a new TLScontext for the new connection and get an SSL
      * structure. Add the location of TLScontext to the SSL to later retrieve
@@ -814,12 +820,8 @@ TLS_SESS_STATE *tls_client_start(const TLS_CLIENT_START_PROPS *props)
     if (protomask != 0)
        SSL_set_options(TLScontext->con,
                   ((protomask & TLS_PROTOCOL_TLSv1) ? SSL_OP_NO_TLSv1 : 0L)
-#ifdef SSL_OP_NO_TLSv1_1
             | ((protomask & TLS_PROTOCOL_TLSv1_1) ? SSL_OP_NO_TLSv1_1 : 0L)
-#endif
-#ifdef SSL_OP_NO_TLSv1_2
             | ((protomask & TLS_PROTOCOL_TLSv1_2) ? SSL_OP_NO_TLSv1_2 : 0L)
-#endif
                 | ((protomask & TLS_PROTOCOL_SSLv3) ? SSL_OP_NO_SSLv3 : 0L)
               | ((protomask & TLS_PROTOCOL_SSLv2) ? SSL_OP_NO_SSLv2 : 0L));
 

diff --git a/postfix/src/tls/tls_server.c b/postfix/src/tls/tls_server.c
index 47be5cc7ec0714c2b80f3469c8e29aabca452a26..8d6bb197e84c329e19fd9bd181393ac521960627 100644 (file)
--- a/postfix/src/tls/tls_server.c
+++ b/postfix/src/tls/tls_server.c
@@ -150,9 +150,10 @@ static SSL_SESSION *get_server_session_cb(SSL *ssl, unsigned char *session_id,
 
 #define GEN_CACHE_ID(buf, id, len, service) \
     do { \
-       buf = vstring_alloc(2 * (len) + 1 + strlen(service) + 3); \
+       buf = vstring_alloc(2 * (len + strlen(service))); \
        hex_encode(buf, (char *) (id), (len)); \
        vstring_sprintf_append(buf, "&s=%s", (service)); \
+       vstring_sprintf_append(buf, "&l=%ld", (long) SSLeay()); \
     } while (0)
 
 
@@ -366,12 +367,8 @@ TLS_APPL_STATE *tls_server_init(const TLS_SERVER_INIT_PROPS *props)
     if (protomask != 0)
        SSL_CTX_set_options(server_ctx,
                   ((protomask & TLS_PROTOCOL_TLSv1) ? SSL_OP_NO_TLSv1 : 0L)
-#ifdef SSL_OP_NO_TLSv1_1
             | ((protomask & TLS_PROTOCOL_TLSv1_1) ? SSL_OP_NO_TLSv1_1 : 0L)
-#endif
-#ifdef SSL_OP_NO_TLSv1_2
             | ((protomask & TLS_PROTOCOL_TLSv1_2) ? SSL_OP_NO_TLSv1_2 : 0L)
-#endif
                 | ((protomask & TLS_PROTOCOL_SSLv3) ? SSL_OP_NO_SSLv3 : 0L)
               | ((protomask & TLS_PROTOCOL_SSLv2) ? SSL_OP_NO_SSLv2 : 0L));
 

diff --git a/postfix/src/util/events.c b/postfix/src/util/events.c
index 50751db961be0abf003675b5d44bc1023c90da7c..a82f6ce7697f2d9bcebaae61b612e82bffeeae41 100644 (file)
--- a/postfix/src/util/events.c
+++ b/postfix/src/util/events.c
@@ -179,6 +179,7 @@ typedef fd_set EVENT_MASK;
 #define EVENT_MASK_SET(fd, mask)       FD_SET((fd), (mask))
 #define EVENT_MASK_ISSET(fd, mask)     FD_ISSET((fd), (mask))
 #define EVENT_MASK_CLR(fd, mask)       FD_CLR((fd), (mask))
+#define EVENT_MASK_CMP(m1, m2) memcmp((m1), (m2), EVENT_MASK_BYTE_COUNT(m1))
 #else
 
  /*
@@ -225,6 +226,8 @@ typedef struct {
        (EVENT_MASK_FD_BYTE((fd), (mask)) & EVENT_MASK_FD_BIT(fd))
 #define EVENT_MASK_CLR(fd, mask) \
        (EVENT_MASK_FD_BYTE((fd), (mask)) &= ~EVENT_MASK_FD_BIT(fd))
+#define EVENT_MASK_CMP(m1, m2) \
+       memcmp((m1)->data, (m2)->data, EVENT_MASK_BYTE_COUNT(m1))
 #endif
 
  /*
@@ -663,8 +666,7 @@ void    event_drain(int time_limit)
     max_time = event_present + time_limit;
     while (event_present < max_time
           && (event_timer_head.pred != &event_timer_head
-              || memcmp(&zero_mask, &event_xmask,
-                        EVENT_MASK_BYTE_COUNT(&zero_mask)) != 0)) {
+              || EVENT_MASK_CMP(&zero_mask, &event_xmask) != 0)) {
        event_loop(1);
 #if (EVENTS_STYLE != EVENTS_STYLE_SELECT)
        if (EVENT_MASK_BYTE_COUNT(&zero_mask)