Wish list:
- With DICT_FLAG_RHS_IS_FILE, should dict_update() open a
- file? base64-encode the value?
-
In smtpd(8) and postscreen(8), set the ehlo_discard_mask
to ~0 so that STARTTLS, BDAT, DSN, etc. work only for clients
that send EHLO.
in the Postfix TLS library, and applies to both <a href="smtpd.8.html">smtpd(8)</a> and the SMTP
server mode of <a href="tlsproxy.8.html">tlsproxy(8)</a>. </p>
-<p> The lookup key is either the verbatim SNI domain name or a an
+<p> The lookup key is either the verbatim SNI domain name or an
ancestor domain prefixed with a leading dot. For internationalized
domains, the lookup key must be in IDNA 2008 A-label form (as
required in the TLS SNI extension). </p>
space is stripped off. Whitespace in lookup keys is supported as of
Postfix 3.2.
- When the <b>-F</b> option is given, the <i>value</i> must specify a filename;
- <a href="postmap.1.html"><b>postmap</b>(1)</a> will store the base64-encoded content of that file instead
- of the <i>value</i> itself.
+ When the <b>-F</b> option is given, the <i>value</i> must specify one or more file-
+ names separated by comma and/or whitespace; <a href="postmap.1.html"><b>postmap</b>(1)</a> will concatenate
+ the file content (with a newline character inserted between files) and
+ will store the base64-encoded result instead of the <i>value</i>.
- When the <i>key</i> specifies email address information, the localpart should
+ When the <i>key</i> specifies email address information, the localpart should
be enclosed with double quotes if required by <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a>. For example, an
address localpart that contains ";", or a localpart that starts or ends
with ".".
- By default the lookup key is mapped to lowercase to make the lookups
+ By default the lookup key is mapped to lowercase to make the lookups
case insensitive; as of Postfix 2.3 this case folding happens only with
tables whose lookup keys are fixed-case strings such as <a href="DATABASE_README.html#types">btree</a>:, <a href="DATABASE_README.html#types">dbm</a>: or
<a href="DATABASE_README.html#types">hash</a>:. With earlier versions, the lookup key is folded even with tables
- where a lookup field can match both upper and lower case text, such as
- <a href="regexp_table.5.html">regexp</a>: and <a href="pcre_table.5.html">pcre</a>:. This resulted in loss of information with $<i>number</i>
+ where a lookup field can match both upper and lower case text, such as
+ <a href="regexp_table.5.html">regexp</a>: and <a href="pcre_table.5.html">pcre</a>:. This resulted in loss of information with $<i>number</i>
substitutions.
<b>COMMAND-LINE ARGUMENTS</b>
- <b>-b</b> Enable message body query mode. When reading lookup keys from
- standard input with "<b>-q -</b>", process the input as if it is an
- email message in <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a> format. Each line of body content
+ <b>-b</b> Enable message body query mode. When reading lookup keys from
+ standard input with "<b>-q -</b>", process the input as if it is an
+ email message in <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a> format. Each line of body content
becomes one lookup key.
- By default, the <b>-b</b> option starts generating lookup keys at the
- first non-header line, and stops when the end of the message is
- reached. To simulate <a href="header_checks.5.html"><b>body_checks</b>(5)</a> processing, enable MIME
- parsing with <b>-m</b>. With this, the <b>-b</b> option generates no
- body-style lookup keys for attachment MIME headers and for
+ By default, the <b>-b</b> option starts generating lookup keys at the
+ first non-header line, and stops when the end of the message is
+ reached. To simulate <a href="header_checks.5.html"><b>body_checks</b>(5)</a> processing, enable MIME
+ parsing with <b>-m</b>. With this, the <b>-b</b> option generates no
+ body-style lookup keys for attachment MIME headers and for
attached message/* headers.
- NOTE: with "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes", the <b>-b</b> option option dis-
- ables UTF-8 syntax checks on query keys and lookup results.
+ NOTE: with "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes", the <b>-b</b> option option dis-
+ ables UTF-8 syntax checks on query keys and lookup results.
Specify the <b>-U</b> option to force UTF-8 syntax checks anyway.
This feature is available in Postfix version 2.6 and later.
<b>-c</b> <i>config</i><b>_</b><i>dir</i>
- Read the <a href="postconf.5.html"><b>main.cf</b></a> configuration file in the named directory
+ Read the <a href="postconf.5.html"><b>main.cf</b></a> configuration file in the named directory
instead of the default configuration directory.
- <b>-d</b> <i>key</i> Search the specified maps for <i>key</i> and remove one entry per map.
- The exit status is zero when the requested information was
+ <b>-d</b> <i>key</i> Search the specified maps for <i>key</i> and remove one entry per map.
+ The exit status is zero when the requested information was
found.
- If a key value of <b>-</b> is specified, the program reads key values
- from the standard input stream. The exit status is zero when at
+ If a key value of <b>-</b> is specified, the program reads key values
+ from the standard input stream. The exit status is zero when at
least one of the requested keys was found.
- <b>-f</b> Do not fold the lookup key to lower case while creating or
+ <b>-f</b> Do not fold the lookup key to lower case while creating or
querying a table.
- With Postfix version 2.3 and later, this option has no effect
+ With Postfix version 2.3 and later, this option has no effect
for regular expression tables. There, case folding is controlled
by appending a flag to a pattern.
- <b>-F</b> When creating a map from source file, replace each value with
- the base64-encoded content of the named file. When querying a
- map, or listing a map, base64-decode each value.
+ <b>-F</b> When querying a map, or listing a map, base64-decode each value.
+ When creating a map from source file, process each value as a
+ list of filenames, concatenate the content of those files, and
+ store the base64-encoded result instead of the value (see INPUT
+ FORMAT for details).
- <b>-h</b> Enable message header query mode. When reading lookup keys from
- standard input with "<b>-q -</b>", process the input as if it is an
- email message in <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a> format. Each logical header line
- becomes one lookup key. A multi-line header becomes one lookup
+ <b>-h</b> Enable message header query mode. When reading lookup keys from
+ standard input with "<b>-q -</b>", process the input as if it is an
+ email message in <a href="http://tools.ietf.org/html/rfc5322">RFC 5322</a> format. Each logical header line
+ becomes one lookup key. A multi-line header becomes one lookup
key with one or more embedded newline characters.
- By default, the <b>-h</b> option generates lookup keys until the first
- non-header line is reached. To simulate <a href="header_checks.5.html"><b>header_checks</b>(5)</a> pro-
- cessing, enable MIME parsing with <b>-m</b>. With this, the <b>-h</b> option
- also generates header-style lookup keys for attachment MIME
+ By default, the <b>-h</b> option generates lookup keys until the first
+ non-header line is reached. To simulate <a href="header_checks.5.html"><b>header_checks</b>(5)</a> pro-
+ cessing, enable MIME parsing with <b>-m</b>. With this, the <b>-h</b> option
+ also generates header-style lookup keys for attachment MIME
headers and for attached message/* headers.
- NOTE: with "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes", the <b>-b</b> option option dis-
- ables UTF-8 syntax checks on query keys and lookup results.
+ NOTE: with "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes", the <b>-b</b> option option dis-
+ ables UTF-8 syntax checks on query keys and lookup results.
Specify the <b>-U</b> option to force UTF-8 syntax checks anyway.
This feature is available in Postfix version 2.6 and later.
- <b>-i</b> Incremental mode. Read entries from standard input and do not
- truncate an existing database. By default, <a href="postmap.1.html"><b>postmap</b>(1)</a> creates a
+ <b>-i</b> Incremental mode. Read entries from standard input and do not
+ truncate an existing database. By default, <a href="postmap.1.html"><b>postmap</b>(1)</a> creates a
new database from the entries in <b>file_name</b>.
<b>-m</b> Enable MIME parsing with "<b>-b</b>" and "<b>-h</b>".
This feature is available in Postfix version 2.6 and later.
- <b>-N</b> Include the terminating null character that terminates lookup
- keys and values. By default, <a href="postmap.1.html"><b>postmap</b>(1)</a> does whatever is the
+ <b>-N</b> Include the terminating null character that terminates lookup
+ keys and values. By default, <a href="postmap.1.html"><b>postmap</b>(1)</a> does whatever is the
default for the host operating system.
- <b>-n</b> Don't include the terminating null character that terminates
- lookup keys and values. By default, <a href="postmap.1.html"><b>postmap</b>(1)</a> does whatever is
+ <b>-n</b> Don't include the terminating null character that terminates
+ lookup keys and values. By default, <a href="postmap.1.html"><b>postmap</b>(1)</a> does whatever is
the default for the host operating system.
- <b>-o</b> Do not release root privileges when processing a non-root input
- file. By default, <a href="postmap.1.html"><b>postmap</b>(1)</a> drops root privileges and runs as
+ <b>-o</b> Do not release root privileges when processing a non-root input
+ file. By default, <a href="postmap.1.html"><b>postmap</b>(1)</a> drops root privileges and runs as
the source file owner instead.
- <b>-p</b> Do not inherit the file access permissions from the input file
- when creating a new file. Instead, create a new file with
+ <b>-p</b> Do not inherit the file access permissions from the input file
+ when creating a new file. Instead, create a new file with
default access permissions (mode 0644).
- <b>-q</b> <i>key</i> Search the specified maps for <i>key</i> and write the first value
- found to the standard output stream. The exit status is zero
+ <b>-q</b> <i>key</i> Search the specified maps for <i>key</i> and write the first value
+ found to the standard output stream. The exit status is zero
when the requested information was found.
- Note: this performs a single query with the key as specified,
- and does not make iterative queries with substrings of the key
- as
described for <a href="access.5.html">access(5)</a>, <a href="canonical.5.html">canonical(5)</a>, <a href="transport.5.html">transport(5)</a>, <a href="virtual.5.html">vir-</a>
+ Note: this performs a single query with the key as specified,
+ and does not make iterative queries with substrings of the key
+ as
described for <a href="access.5.html">access(5)</a>, <a href="canonical.5.html">canonical(5)</a>, <a href="transport.5.html">transport(5)</a>, <a href="virtual.5.html">vir-</a>
<a href="virtual.5.html">tual(5)</a> and other Postfix table-driven features.
- If a key value of <b>-</b> is specified, the program reads key values
- from the standard input stream and writes one line of <i>key value</i>
+ If a key value of <b>-</b> is specified, the program reads key values
+ from the standard input stream and writes one line of <i>key value</i>
output for each key that was found. The exit status is zero when
at least one of the requested keys was found.
- <b>-r</b> When updating a table, do not complain about attempts to update
+ <b>-r</b> When updating a table, do not complain about attempts to update
existing entries, and make those updates anyway.
- <b>-s</b> Retrieve all database elements, and write one line of <i>key value</i>
- output for each element. The elements are printed in database
- order, which is not necessarily the same as the original input
+ <b>-s</b> Retrieve all database elements, and write one line of <i>key value</i>
+ output for each element. The elements are printed in database
+ order, which is not necessarily the same as the original input
order.
- This feature is available in Postfix version 2.2 and later, and
+ This feature is available in Postfix version 2.2 and later, and
is not available for all database types.
- <b>-u</b> Disable UTF-8 support. UTF-8 support is enabled by default when
- "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes". It requires that keys and values are
+ <b>-u</b> Disable UTF-8 support. UTF-8 support is enabled by default when
+ "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes". It requires that keys and values are
valid UTF-8 strings.
<b>-U</b> With "<a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> = yes", force UTF-8 syntax checks with the
<b>-b</b> and <b>-h</b> options.
- <b>-v</b> Enable verbose logging for debugging purposes. Multiple <b>-v</b>
+ <b>-v</b> Enable verbose logging for debugging purposes. Multiple <b>-v</b>
options make the software increasingly verbose.
- <b>-w</b> When updating a table, do not complain about attempts to update
+ <b>-w</b> When updating a table, do not complain about attempts to update
existing entries, and ignore those attempts.
Arguments:
The <a href="postmap.1.html"><b>postmap</b>(1)</a> command can query any supported file type, but it
can create only the following file types:
- <b>btree</b> The output file is a btree file, named <i>file</i><b>_</b><i>name</i><b>.db</b>.
- This is available on systems with support for <b>db</b> data-
+ <b>btree</b> The output file is a btree file, named <i>file</i><b>_</b><i>name</i><b>.db</b>.
+ This is available on systems with support for <b>db</b> data-
bases.
- <b>cdb</b> The output consists of one file, named <i>file</i><b>_</b><i>name</i><b>.cdb</b>.
- This is available on systems with support for <b>cdb</b> data-
+ <b>cdb</b> The output consists of one file, named <i>file</i><b>_</b><i>name</i><b>.cdb</b>.
+ This is available on systems with support for <b>cdb</b> data-
bases.
<b>dbm</b> The output consists of two files, named <i>file</i><b>_</b><i>name</i><b>.pag</b> and
<i>file</i><b>_</b><i>name</i><b>.dir</b>. This is available on systems with support
for <b>dbm</b> databases.
- <b>hash</b> The output file is a hashed file, named <i>file</i><b>_</b><i>name</i><b>.db</b>.
- This is available on systems with support for <b>db</b> data-
+ <b>hash</b> The output file is a hashed file, named <i>file</i><b>_</b><i>name</i><b>.db</b>.
+ This is available on systems with support for <b>db</b> data-
bases.
- <b>fail</b> A table that reliably fails all requests. The lookup ta-
- ble name is used for logging only. This table exists to
+ <b>fail</b> A table that reliably fails all requests. The lookup ta-
+ ble name is used for logging only. This table exists to
simplify Postfix error tests.
<b>sdbm</b> The output consists of two files, named <i>file</i><b>_</b><i>name</i><b>.pag</b> and
<i>file</i><b>_</b><i>name</i><b>.dir</b>. This is available on systems with support
for <b>sdbm</b> databases.
- When no <i>file</i><b>_</b><i>type</i> is specified, the software uses the database
- type specified via the <b><a href="postconf.5.html#default_database_type">default_database_type</a></b> configuration
+ When no <i>file</i><b>_</b><i>type</i> is specified, the software uses the database
+ type specified via the <b><a href="postconf.5.html#default_database_type">default_database_type</a></b> configuration
parameter.
<i>file</i><b>_</b><i>name</i>
<b>DIAGNOSTICS</b>
Problems are logged to the standard error stream and to <b>syslogd</b>(8). No
- output means that no problems were detected. Duplicate entries are
+ output means that no problems were detected. Duplicate entries are
skipped and are flagged with a warning.
<a href="postmap.1.html"><b>postmap</b>(1)</a> terminates with zero exit status in case of success (includ-
- ing successful "<b>postmap -q</b>" lookup) and terminates with non-zero exit
+ ing successful "<b>postmap -q</b>" lookup) and terminates with non-zero exit
status in case of failure.
<b>ENVIRONMENT</b>
Enable verbose logging for debugging purposes.
<b>CONFIGURATION PARAMETERS</b>
- The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro-
- gram.
The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a>
+ The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro-
+ gram.
The text below provides only a parameter summary. See <a href="postconf.5.html"><b>post-</b></a>
<a href="postconf.5.html"><b>conf</b>(5)</a> for more details including examples.
<b><a href="postconf.5.html#berkeley_db_create_buffer_size">berkeley_db_create_buffer_size</a> (16777216)</b>
- The per-table I/O buffer size for programs that create Berkeley
+ The per-table I/O buffer size for programs that create Berkeley
DB hash or btree tables.
<b><a href="postconf.5.html#berkeley_db_read_buffer_size">berkeley_db_read_buffer_size</a> (131072)</b>
hash or btree tables.
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
figuration files.
<b><a href="postconf.5.html#default_database_type">default_database_type</a> (see 'postconf -d' output)</b>
and <a href="postmap.1.html"><b>postmap</b>(1)</a> commands.
<b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
- The list of environment parameters that a privileged Postfix
- process will import from a non-Postfix parent process, or
+ The list of environment parameters that a privileged Postfix
+ process will import from a non-Postfix parent process, or
name=value environment overrides.
<b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b>
- Enable preliminary SMTPUTF8 support for the protocols described
+ Enable preliminary SMTPUTF8 support for the protocols described
in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533.
<b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b>
The syslog facility of Postfix logging.
<b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
- A prefix that is prepended to the process name in syslog
+ A prefix that is prepended to the process name in syslog
records, so that, for example, "smtpd" becomes "prefix/smtpd".
<b>SEE ALSO</b>
keys is supported as of Postfix 3.2.
When the \fB\-F\fR option is given, the \fIvalue\fR must
-specify a filename; \fBpostmap\fR(1) will store the
-base64\-encoded content of that file instead of the \fIvalue\fR
-itself.
+specify one or more filenames separated by comma and/or
+whitespace; \fBpostmap\fR(1) will concatenate the file
+content (with a newline character inserted between files)
+and will store the base64\-encoded result instead of the
+\fIvalue\fR.
When the \fIkey\fR specifies email address information, the
localpart should be enclosed with double quotes if required
effect for regular expression tables. There, case folding
is controlled by appending a flag to a pattern.
.IP \fB\-F\fR
-When creating a map from source file, replace each value
-with the base64\-encoded content of the named file. When
-querying a map, or listing a map, base64\-decode each value.
+When querying a map, or listing a map, base64\-decode each
+value. When creating a map from source file, process each
+value as a list of filenames, concatenate the content of
+those files, and store the base64\-encoded result instead
+of the value (see INPUT FORMAT for details).
.IP \fB\-h\fR
Enable message header query mode. When reading lookup keys
from standard input with "\fB\-q \-\fR", process the input
in the Postfix TLS library, and applies to both \fBsmtpd\fR(8) and the SMTP
server mode of \fBtlsproxy\fR(8).
.PP
-The lookup key is either the verbatim SNI domain name or a an
+The lookup key is either the verbatim SNI domain name or an
ancestor domain prefixed with a leading dot. For internationalized
domains, the lookup key must be in IDNA 2008 A\-label form (as
required in the TLS SNI extension).
in the Postfix TLS library, and applies to both smtpd(8) and the SMTP
server mode of tlsproxy(8). </p>
-<p> The lookup key is either the verbatim SNI domain name or a an
+<p> The lookup key is either the verbatim SNI domain name or an
ancestor domain prefixed with a leading dot. For internationalized
domains, the lookup key must be in IDNA 2008 A-label form (as
required in the TLS SNI extension). </p>
* Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only.
*/
-#define MAIL_RELEASE_DATE "20181229"
+#define MAIL_RELEASE_DATE "20190106"
#define MAIL_VERSION_NUMBER "3.4"
#ifdef SNAPSHOT
/* keys is supported as of Postfix 3.2.
/*
/* When the \fB-F\fR option is given, the \fIvalue\fR must
-/* specify a filename; \fBpostmap\fR(1) will store the
-/* base64-encoded content of that file instead of the \fIvalue\fR
-/* itself.
+/* specify one or more filenames separated by comma and/or
+/* whitespace; \fBpostmap\fR(1) will concatenate the file
+/* content (with a newline character inserted between files)
+/* and will store the base64-encoded result instead of the
+/* \fIvalue\fR.
/*
/* When the \fIkey\fR specifies email address information, the
/* localpart should be enclosed with double quotes if required
/* effect for regular expression tables. There, case folding
/* is controlled by appending a flag to a pattern.
/* .IP \fB-F\fR
-/* When creating a map from source file, replace each value
-/* with the base64-encoded content of the named file. When
-/* querying a map, or listing a map, base64-decode each value.
+/* When querying a map, or listing a map, base64-decode each
+/* value. When creating a map from source file, process each
+/* value as a list of filenames, concatenate the content of
+/* those files, and store the base64-encoded result instead
+/* of the value (see INPUT FORMAT for details).
/* .IP \fB-h\fR
/* Enable message header query mode. When reading lookup keys
/* from standard input with "\fB-q -\fR", process the input
if ((unb64 = dict_file_from_b64(dict, value)) == 0) {
err = dict_file_get_error(dict);
msg_warn("table %s:%s: key %s: %s",
- dict->type, dict->name,
- key, err);
+ dict->type, dict->name, key, err);
myfree(err);
+ /* dict->error = DICT_ERR_CONFIG; */
continue;
}
value = STR(unb64);
/* tls_load_pem_chain() loads one or more (key, cert, [chain])
/* triples from an in-memory PEM blob. The "origin" argument
/* is used for error logging, to identify the provenance of the
-/* PEM blob. Exactly one of "ctx" or "ssl" must be non-zero,
-/* and the keys and certificates will be loaded into that object.
+/* PEM blob. "ssl" must be non-zero, and the keys and certificates
+/* will be loaded into that object.
/* LICENSE
/* .ad
/* .fi
#define TLS_INTERNAL
#include <tls.h>
-#define STATE_PEM_NOGO -2 /* Unusable object or sequence */
-#define STATE_PEM_FAIL -1 /* Error in libcrypto */
-#define STATE_PEM_DONE 0 /* End of PEM file, return value only */
-#define STATE_PEM_INIT 1 /* No PEM objects seen */
-#define STATE_PEM_PKEY 2 /* Last object was a private key */
-#define STATE_PEM_CERT 3 /* Last object was a certificate */
-#define STATE_PEM_BOTH 4 /* Unordered, key + first cert seen */
+#define PEM_LOAD_STATE_NOGO -2 /* Unusable object or sequence */
+#define PEM_LOAD_STATE_FAIL -1 /* Error in libcrypto */
+#define PEM_LOAD_STATE_DONE 0 /* End of PEM file, return value only */
+#define PEM_LOAD_STATE_INIT 1 /* No PEM objects seen */
+#define PEM_LOAD_STATE_PKEY 2 /* Last object was a private key */
+#define PEM_LOAD_STATE_CERT 3 /* Last object was a certificate */
+#define PEM_LOAD_STATE_BOTH 4 /* Unordered, key + first cert seen */
-#define LOAD_MODE_MIXED 0 /* Key order not fixed */
-#define LOAD_MODE_MORE 1 /* Keys first, more files */
-#define LOAD_MODE_LAST 2 /* Keys first, last file */
+#define PEM_LOAD_MODE_MIXED 0 /* Key order not fixed */
+#define PEM_LOAD_MODE_MORE 1 /* Keys first, more files */
+#define PEM_LOAD_MODE_LAST 2 /* Keys first, last file */
-typedef struct pem_load_state {
+typedef struct pem_load_state_t {
const char *origin; /* PEM chain origin description */
const char *source; /* PEM BIO origin description */
const char *keysrc; /* Source of last key */
int keynum; /* Index of last key */
int objnum; /* Index in current source */
int state; /* Current state, never "DONE" */
-} pem_load_state;
+} pem_load_state_t;
/* init_pem_load_state - fill in initial pem_load_state structure */
-static void init_pem_load_state(pem_load_state *st, SSL_CTX *ctx, SSL *ssl,
+static void init_pem_load_state(pem_load_state_t *st, SSL_CTX *ctx, SSL *ssl,
const char *origin)
{
st->origin = origin;
st->chain = 0;
st->keynum = 0;
st->objnum = 0;
- st->state = STATE_PEM_INIT;
+ st->state = PEM_LOAD_STATE_INIT;
}
/* use_chain - load cert, key and chain into ctx or ssl */
#if OPENSSL_VERSION_NUMBER >= 0x1010100fUL
-static int use_chain(pem_load_state *st)
+static int use_chain(pem_load_state_t *st)
{
int ret;
int replace = 0;
#else
/* Legacy OpenSSL 1.0.2 and 1.1.0 interface */
-static int use_chain(pem_load_state *st)
+static int use_chain(pem_load_state_t *st)
{
int ret = 1;
/* load_cert - decode and load a DER-encoded X509 certificate */
-static void load_cert(pem_load_state *st, int mode, unsigned char *buf,
+static void load_cert(pem_load_state_t *st, int mode, unsigned char *buf,
long buflen)
{
const unsigned char *p = buf;
* When expecting one or more keys, each key must precede the associated
* certicate (chain).
*/
- if (mode != LOAD_MODE_MIXED && st->state == STATE_PEM_INIT) {
+ if (mode != PEM_LOAD_MODE_MIXED && st->state == PEM_LOAD_STATE_INIT) {
msg_warn("error loading chain from %s: key not first", st->source);
if (cert)
X509_free(cert);
- st->state = STATE_PEM_NOGO;
+ st->state = PEM_LOAD_STATE_NOGO;
return;
}
if (!cert) {
msg_warn("error loading certificate (PEM object number %d) from %s",
st->objnum, st->source);
- st->state = STATE_PEM_FAIL;
+ st->state = PEM_LOAD_STATE_FAIL;
return;
}
if (p - buf != buflen) {
msg_warn("error loading certificate (PEM object number %d) from %s:"
" excess data", st->objnum, st->source);
X509_free(cert);
- st->state = STATE_PEM_NOGO;
+ st->state = PEM_LOAD_STATE_NOGO;
return;
}
/*
* The first certificate after a new key becomes the leaf certificate for
- * that key, and the additional issuer certificte list is cleared.
+ * that key, and the additional issuer certificate list is cleared.
* Subsequent certificates are added to the issuer chain (without an
* "upref" so they are now owne by the chain, and must not be freed).
*
} else if ((!st->chain && (st->chain = sk_X509_new_null()) == 0)
|| !sk_X509_push(st->chain, cert)) {
X509_free(cert);
- st->state = STATE_PEM_FAIL;
+ st->state = PEM_LOAD_STATE_FAIL;
return;
}
- if (st->state == STATE_PEM_INIT) {
- st->state = STATE_PEM_CERT;
+ if (st->state == PEM_LOAD_STATE_INIT) {
+ st->state = PEM_LOAD_STATE_CERT;
return;
}
- if (st->state != STATE_PEM_PKEY)
+ if (st->state != PEM_LOAD_STATE_PKEY)
return;
- if (mode == LOAD_MODE_MIXED)
- st->state = STATE_PEM_BOTH;
+ if (mode == PEM_LOAD_MODE_MIXED)
+ st->state = PEM_LOAD_STATE_BOTH;
else
- st->state = STATE_PEM_CERT;
+ st->state = PEM_LOAD_STATE_CERT;
}
/* load_pkey - decode and load a DER-encoded private key */
-static void load_pkey(pem_load_state *st, int mode, int pkey_type,
+static void load_pkey(pem_load_state_t *st, int mode, int pkey_type,
unsigned char *buf, long buflen)
{
const char *myname = "load_pkey";
* ignored with a warning.
*/
switch (st->state) {
- case STATE_PEM_INIT:
+ case PEM_LOAD_STATE_INIT:
break;
- case STATE_PEM_CERT:
+ case PEM_LOAD_STATE_CERT:
/*
* When processing the key of a "next" chain, we're in the "CERT"
* state, and first complete the processing of the previous chain.
*/
- if (mode != LOAD_MODE_MIXED && !use_chain(st)) {
+ if (mode != PEM_LOAD_MODE_MIXED && !use_chain(st)) {
msg_warn("error loading certificate chain: "
"key number %d in %s does not match the certificate",
st->keynum, st->keysrc);
- st->state = STATE_PEM_FAIL;
+ st->state = PEM_LOAD_STATE_FAIL;
return;
}
break;
- case STATE_PEM_PKEY:
- case STATE_PEM_BOTH:
+ case PEM_LOAD_STATE_PKEY:
+ case PEM_LOAD_STATE_BOTH:
if (pkey)
EVP_PKEY_free(pkey);
/* XXX: Legacy behaviour was silent, should we stay silent? */
- if (mode == LOAD_MODE_MIXED) {
+ if (mode == PEM_LOAD_MODE_MIXED) {
msg_warn("ignoring 2nd key at index %d in %s after 1st at %d",
st->objnum, st->source, st->keynum);
return;
msg_warn("error loading certificate chain: "
"key number %d in %s not followed by a certificate",
st->keynum, st->keysrc);
- st->state = STATE_PEM_NOGO;
+ st->state = PEM_LOAD_STATE_NOGO;
return;
default:
msg_error("%s: internal error: bad state: %d", myname, st->state);
- st->state = STATE_PEM_NOGO;
+ st->state = PEM_LOAD_STATE_NOGO;
return;
}
if (!pkey) {
msg_warn("error loading private key (PEM object number %d) from %s",
st->objnum, st->source);
- st->state = STATE_PEM_FAIL;
+ st->state = PEM_LOAD_STATE_FAIL;
return;
}
/* Reject unexpected data beyond the end of the DER-encoded object */
msg_warn("error loading private key (PEM object number %d) from %s:"
" excess data", st->objnum, st->source);
EVP_PKEY_free(pkey);
- st->state = STATE_PEM_NOGO;
+ st->state = PEM_LOAD_STATE_NOGO;
return;
}
/* All's well, update the state */
st->pkey = pkey;
- if (st->state == STATE_PEM_INIT) {
- st->state = STATE_PEM_PKEY;
+ if (st->state == PEM_LOAD_STATE_INIT) {
+ st->state = PEM_LOAD_STATE_PKEY;
return;
}
- if (st->state != STATE_PEM_CERT)
+ if (st->state != PEM_LOAD_STATE_CERT)
return;
- if (mode == LOAD_MODE_MIXED)
- st->state = STATE_PEM_BOTH;
+ if (mode == PEM_LOAD_MODE_MIXED)
+ st->state = PEM_LOAD_STATE_BOTH;
else
- st->state = STATE_PEM_PKEY;
+ st->state = PEM_LOAD_STATE_PKEY;
}
/* load_pem_object - load next pkey or cert from open BIO */
-static int load_pem_object(pem_load_state *st, int mode)
+static int load_pem_object(pem_load_state_t *st, int mode)
{
char *name = 0;
char *header = 0;
if (!PEM_read_bio(st->pembio, &name, &header, &buf, &buflen)) {
if (ERR_GET_REASON(ERR_peek_last_error()) != PEM_R_NO_START_LINE)
- return (st->state = STATE_PEM_FAIL);
+ return (st->state = PEM_LOAD_STATE_FAIL);
ERR_clear_error();
/* Clean EOF, preserve stored state for any next input file */
- return (STATE_PEM_DONE);
+ return (PEM_LOAD_STATE_DONE);
}
if (strcmp(name, PEM_STRING_X509) == 0
|| strcmp(name, PEM_STRING_X509_OLD) == 0) {
|| ((pkey_type = EVP_PKEY_DSA) != NID_undef
&& strcmp(name, PEM_STRING_DSA) == 0)) {
load_pkey(st, mode, pkey_type, buf, buflen);
- } else if (mode != LOAD_MODE_MIXED) {
+ } else if (mode != PEM_LOAD_MODE_MIXED) {
msg_warn("error loading %s: unexpected PEM type: %s", st->source, name);
- st->state = STATE_PEM_NOGO;
+ st->state = PEM_LOAD_STATE_NOGO;
}
OPENSSL_free(name);
OPENSSL_free(header);
/* load_pem_bio - load all key/certs from bio and free the bio */
-static int load_pem_bio(pem_load_state *st, int mode)
+static int load_pem_bio(pem_load_state_t *st, int mode)
{
int state = st->state;
ERR_clear_error();
/*
- * When "mode" == LOAD_MODE_MORE, more files will be loaded after the
+ * When "mode" ==PEM_LOAD_MODE_MORE, more files will be loaded after the
* current file, and final processing for the last key and chain is
* deferred.
*
- * When "mode" == LOAD_MODE_LAST, this is the last file in the list, and we
- * validate the final chain.
+ * When "mode" ==PEM_LOAD_MODE_LAST, this is the last file in the list, and
+ * we validate the final chain.
*
- * When "mode" == LOAD_MODE_MIXED, this is the only file, and its key can
+ * When "mode" ==PEM_LOAD_MODE_MIXED, this is the only file, and its key can
* occur at any location. In this case we load at most one key.
*/
- for (st->objnum = 1; state > STATE_PEM_DONE; ++st->objnum) {
+ for (st->objnum = 1; state > PEM_LOAD_STATE_DONE; ++st->objnum) {
state = load_pem_object(st, mode);
- if (state == STATE_PEM_PKEY || state == STATE_PEM_BOTH) {
- if (mode != LOAD_MODE_MIXED) {
- st->keynum = st->objnum;
- st->keysrc = st->source;
- } else if (st->keynum == 0) {
+ if (state == PEM_LOAD_STATE_PKEY || state == PEM_LOAD_STATE_BOTH) {
+ if (mode != PEM_LOAD_MODE_MIXED
+ || (mode == PEM_LOAD_MODE_MIXED && st->keynum == 0)) {
st->keynum = st->objnum;
st->keysrc = st->source;
}
BIO_free(st->pembio);
/* Success with current file, go back for more? */
- if (mode == LOAD_MODE_MORE && state >= STATE_PEM_DONE)
+ if (mode == PEM_LOAD_MODE_MORE && state >= PEM_LOAD_STATE_DONE)
return 0;
/*
* If all is well so far, complete processing for the final chain.
*/
- if (st->state >= STATE_PEM_INIT) {
- if (st->state == STATE_PEM_INIT) {
+ if (st->state >= PEM_LOAD_STATE_INIT) {
+ if (st->state == PEM_LOAD_STATE_INIT) {
msg_warn("No PEM data in %s", st->origin);
- st->state = STATE_PEM_NOGO;
- } else if (st->state == STATE_PEM_PKEY) {
+ st->state = PEM_LOAD_STATE_NOGO;
+ } else if (st->state == PEM_LOAD_STATE_PKEY) {
msg_warn("No certs for key number %d in %s",
st->keynum, st->keysrc);
- st->state = STATE_PEM_NOGO;
- } else if (mode == LOAD_MODE_MIXED && st->state == STATE_PEM_CERT) {
+ st->state = PEM_LOAD_STATE_NOGO;
+ } else if (mode == PEM_LOAD_MODE_MIXED && st->state == PEM_LOAD_STATE_CERT) {
msg_warn("No private key found in %s", st->origin);
- st->state = STATE_PEM_NOGO;
+ st->state = PEM_LOAD_STATE_NOGO;
} else if (!use_chain(st)) {
msg_warn("key number %d in %s does not match next certificate",
st->keynum, st->keysrc);
- st->state = STATE_PEM_FAIL;
+ st->state = PEM_LOAD_STATE_FAIL;
} else {
/* use_chain() freed the key and certs, and zeroed the pointers */
return (0);
sk_X509_pop_free(st->chain, X509_free);
switch (st->state) {
- case STATE_PEM_FAIL:
+ case PEM_LOAD_STATE_FAIL:
tls_print_errors();
/* FALLTHROUGH */
default:
static int load_chain_files(SSL_CTX *ctx, const char *chain_files)
{
- pem_load_state st;
+ pem_load_state_t st;
ARGV *files = argv_split(chain_files, CHARS_COMMA_SP);
char **filep;
int ret = 0;
st.source = *filep;
if ((st.pembio = BIO_new_file(st.source, "r")) == NULL) {
msg_warn("error opening chain file: %s: %m", st.source);
- st.state = STATE_PEM_NOGO;
+ st.state = PEM_LOAD_STATE_NOGO;
break;
}
- mode = filep[1] ? LOAD_MODE_MORE : LOAD_MODE_LAST;
+ mode = filep[1] ? PEM_LOAD_MODE_MORE : PEM_LOAD_MODE_LAST;
/* load_pem_bio() frees the BIO */
ret = load_pem_bio(&st, mode);
}
* single pass, avoiding potential race conditions during key rollover.
*/
if (strcmp(cert_file, key_file) == 0) {
- pem_load_state st;
+ pem_load_state_t st;
init_pem_load_state(&st, ctx, 0, cert_file);
if ((st.pembio = BIO_new_file(st.source, "r")) == NULL) {
return (-1);
}
/* load_pem_bio() frees the BIO */
- return (load_pem_bio(&st, LOAD_MODE_MIXED) == 0);
+ return (load_pem_bio(&st, PEM_LOAD_MODE_MIXED) == 0);
}
/*
int tls_load_pem_chain(SSL *ssl, const char *pem, const char *origin)
{
static VSTRING *obuf;
- pem_load_state st;
+ pem_load_state_t st;
if (!obuf)
obuf = vstring_alloc(100);
return (-1);
}
/* load_pem_bio() frees the BIO */
- return (load_pem_bio(&st, LOAD_MODE_LAST));
+ return (load_pem_bio(&st, PEM_LOAD_MODE_LAST));
}
#endif
/*
/* const char **tls_pkey_algorithms(void)
/*
+/* void tls_pre_jail_init(TLS_ROLE)
+/* TLS_ROLE role;
+/*
/* .SH Internal functions
/* .nf
/* .na
/*
/* void tls_param_init()
/*
-/* void tls_pre_jail_init(TLS_ROLE)
-/* TLS_ROLE role;
-/*
/* int tls_protocol_mask(plist)
/* const char *plist;
/*
return (0);
if ((unb64 = dict_file_from_b64(dict, res)) == 0) {
err = dict_file_get_error(dict);
- msg_warn("table %s:%s: key %s: %s",
- dict->type, dict->name,
- key, err);
+ msg_warn("table %s:%s: key %s: %s", dict->type, dict->name, key, err);
myfree(err);
dict->error = DICT_ERR_CONFIG;
return (0);
/* request with a non-UTF-8 key, skip an update request with
/* a non-UTF-8 value, and fail a lookup request with a non-UTF-8
/* value.
+/* .IP DICT_FLAG_SRC_RHS_IS_FILE
+/* With dictionaries that are created from source text, each
+/* value in the source of a dictionary specifies a list of
+/* file names separated by comma and/or whitespace. The file
+/* contents are concatenated with a newline inserted between
+/* files, and the base64-encoded result is stored under the
+/* key.
+/* .sp
+/* NOTE 1: it is up to the application to decode lookup results
+/* with dict_file_lookup() or equivalent (this requires that
+/* the dictionary is opened with DICT_FLAG_SRC_RHS_IS_FILE).
+/* Decoding is not built into the normal dictionary lookup
+/* method, because that would complicate dictionary nesting,
+/* pipelining, and proxying.
+/* .sp
+/* NOTE 2: it is up to the application to convert file names
+/* into base64-encoded file content before calling the dictionary
+/* update method (see dict_file(3) for support). Automatic
+/* file content encoding is available only when a dictionary
+/* is created from source text.
/* .PP
/* Specify DICT_FLAG_NONE for no special processing.
/*
projects / thirdparty / postfix.git / commitdiff
