From: Wietse Venema Date: Tue, 15 Jun 2010 05:00:00 +0000 (-0500) Subject: postfix-2.7.2-RC1 X-Git-Tag: v2.7.2-RC1^0 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=56280b7d758be376d856a3849208b3f38a3f55aa;p=thirdparty%2Fpostfix.git postfix-2.7.2-RC1 --- diff --git a/postfix/HISTORY b/postfix/HISTORY index 68a4c060b..9341ca66b 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -15768,3 +15768,15 @@ Apologies for any names omitted. Portability: Berkeley DB 5.x has the same API as Berkeley DB 4.1 and later. File: util/dict_db.c. + +20100610 + + Bugfix: Postfix no longer appends the system default CAs + to the lists specified with *_tls_CAfile or with *_tls_CApath. + This prevents third-party certificates from being trusted + and given mail relay permission with permit_tls_all_clientcerts. + This change may break valid configurations that do not use + permit_tls_all_clientcerts. To get the old behavior, specify + "tls_append_default_CA = yes". Files: tls/tls_certkey.c, + tls/tls_misc.c, global/mail_params.h. proto/postconf.proto, + mantools/postlink. diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index 8632638f7..ddc1ee3d2 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -14,6 +14,18 @@ specifies the release date of a stable release or snapshot release. If you upgrade from Postfix 2.5 or earlier, read RELEASE_NOTES-2.6 before proceeding. +Incompatibility with Postfix 2.7.2 +---------------------------------- + +Postfix no longer appends the system-supplied default CAs to the +lists specified with *_tls_CAfile or with *_tls_CApath. This prevents +third-party certificates from being trusted and given mail relay +permission with permit_tls_all_clientcerts. + +Unfortunately this change may break certificate verification on +sites that don't use permit_tls_all_clientcerts. Specify +"tls_append_default_CA = yes" for backwards compatibility. + Major changes - performance --------------------------- diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html index eed69738a..7e9bdaf20 100644 --- a/postfix/html/postconf.5.html +++ b/postfix/html/postconf.5.html @@ -9150,6 +9150,10 @@ file may also be used to augment the client certificate trust chain, but it is best to include all the required certificates directly in $smtp_tls_cert_file.

+

Specify "tls_append_default_CA = no" to prevent Postfix from +appending the system-supplied default CAs and trusting third-party +certificates.

+

Example: 

@@ -9173,6 +9177,10 @@ with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs".
 
 To use this option in chroot mode, this directory (or a copy)
 must be inside the chroot jail. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. 

+
 
 Example: 

 
 
@@ -10824,8 +10832,11 @@ authenticated via the RFC 4954
 
 Permit the request when the remote SMTP client certificate is
 verified successfully.  This option must be used only if a special
 CA issues the certificates and only this CA is listed as trusted
-CA, otherwise all clients with a recognized certificate would be
-allowed to relay. This feature is available with Postfix version 2.2.

+CA. Otherwise, clients with a third-party certificate would also
+be allowed to relay.  Specify "tls_append_default_CA = no" when the
+trusted CA is specified with smtpd_tls_CAfile or smtpd_tls_CApath,
+to prevent Postfix from appending the system-supplied default CAs.
+This feature is available with Postfix version 2.2.
 
 
permit_tls_clientcerts

 
@@ -12595,6 +12606,10 @@ file may also be used to augment the server certificate trust chain,
 but it is best to include all the required certificates directly in the
 server certificate file. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. 

+
 
 By default (see smtpd_tls_ask_ccert), client certificates are not
 requested, and smtpd_tls_CAfile should remain empty. If you do make use
 of client certificates, the distinguished names (DNs) of the certificate
@@ -12626,6 +12641,10 @@ for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". To use
 smtpd_tls_CApath in chroot mode, this directory (or a copy) must be
 inside the chroot jail. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. 

+
 
 By default (see smtpd_tls_ask_ccert), client certificates are
 not requested, and smtpd_tls_CApath should remain empty. In contrast
 to smtpd_tls_CAfile, DNs of certificate authorities installed
@@ -13737,6 +13756,23 @@ connections.  Next, you enable Postfix TCP servers with the updated
 
 This feature is available in Postfix 2.6 and later. 

 
 
+
+
+
tls_append_default_CA
+(default: no)

+
+
 Append the system-supplied default certificate authority
+certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
+The default is "no"; this prevents Postfix from trusting third-party
+certificates and giving them relay permission with
+permit_tls_all_clientcerts.  

+
+
 This feature is available in Postfix 2.4.15, 2.6.8, 2.7.2 and
+later versions. Specify "tls_append_default_CA = yes" for backwards
+compatibility, to avoid breaking certificate verification with sites
+that don't use permit_tls_all_clientcerts. 

+
+
 

 
 
tls_daemon_random_bytes
diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5
index ce268625e..0fe7c2d40 100644
--- a/postfix/man/man5/postconf.5
+++ b/postfix/man/man5/postconf.5
@@ -5239,6 +5239,10 @@ file may also be used to augment the client certificate trust chain,
 but it is best to include all the required certificates directly in
 $smtp_tls_cert_file.
 .PP
+Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates.
+.PP
 Example:
 .PP
 .nf
@@ -5259,6 +5263,10 @@ with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs".
 To use this option in chroot mode, this directory (or a copy)
 must be inside the chroot jail.
 .PP
+Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates.
+.PP
 Example:
 .PP
 .nf
@@ -6622,8 +6630,11 @@ authenticated via the RFC 4954 (AUTH) protocol.
 Permit the request when the remote SMTP client certificate is
 verified successfully.  This option must be used only if a special
 CA issues the certificates and only this CA is listed as trusted
-CA, otherwise all clients with a recognized certificate would be
-allowed to relay. This feature is available with Postfix version 2.2.
+CA. Otherwise, clients with a third-party certificate would also
+be allowed to relay.  Specify "tls_append_default_CA = no" when the
+trusted CA is specified with smtpd_tls_CAfile or smtpd_tls_CApath,
+to prevent Postfix from appending the system-supplied default CAs.
+This feature is available with Postfix version 2.2.
 .IP "\fBpermit_tls_clientcerts\fR"
 Permit the request when the remote SMTP client certificate
 fingerprint is listed in $relay_clientcerts.
@@ -7828,6 +7839,10 @@ file may also be used to augment the server certificate trust chain,
 but it is best to include all the required certificates directly in the
 server certificate file.
 .PP
+Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates.
+.PP
 By default (see smtpd_tls_ask_ccert), client certificates are not
 requested, and smtpd_tls_CAfile should remain empty. If you do make use
 of client certificates, the distinguished names (DNs) of the certificate
@@ -7857,6 +7872,10 @@ for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". To use
 smtpd_tls_CApath in chroot mode, this directory (or a copy) must be
 inside the chroot jail.
 .PP
+Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates.
+.PP
 By default (see smtpd_tls_ask_ccert), client certificates are
 not requested, and smtpd_tls_CApath should remain empty. In contrast
 to smtpd_tls_CAfile, DNs of certificate authorities installed
@@ -8711,6 +8730,17 @@ tcp_windowsize change will work only for Postfix TCP clients (\fBsmtp\fR(8),
 \fBlmtp\fR(8)).
 .PP
 This feature is available in Postfix 2.6 and later.
+.SH tls_append_default_CA (default: no)
+Append the system-supplied default certificate authority
+certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
+The default is "no"; this prevents Postfix from trusting third-party
+certificates and giving them relay permission with
+permit_tls_all_clientcerts.
+.PP
+This feature is available in Postfix 2.4.15, 2.6.8, 2.7.2 and
+later versions. Specify "tls_append_default_CA = yes" for backwards
+compatibility, to avoid breaking certificate verification with sites
+that don't use permit_tls_all_clientcerts.
 .SH tls_daemon_random_bytes (default: 32)
 The number of pseudo-random bytes that an \fBsmtp\fR(8) or \fBsmtpd\fR(8)
 process requests from the \fBtlsmgr\fR(8) server in order to seed its
diff --git a/postfix/mantools/postlink b/postfix/mantools/postlink
index de775e6e1..13001cb45 100755
--- a/postfix/mantools/postlink
+++ b/postfix/mantools/postlink
@@ -676,6 +676,7 @@ while (<>) {
     s;\btls_null_cipherlist\b;$&;g;
     s;\btls_eecdh_strong_curve\b;$&;g;
     s;\btls_eecdh_ultra_curve\b;$&;g;
+    s;\btls_append_default_CA\b;$&;g;
  
     s;\bfrozen_delivered_to\b;$&;g;
 
diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto
index e4f6e8f2d..aae536c4e 100644
--- a/postfix/proto/postconf.proto
+++ b/postfix/proto/postconf.proto
@@ -4855,8 +4855,11 @@ authenticated via the RFC 4954 (AUTH) protocol. 
 
 Permit the request when the remote SMTP client certificate is
 verified successfully.  This option must be used only if a special
 CA issues the certificates and only this CA is listed as trusted
-CA, otherwise all clients with a recognized certificate would be
-allowed to relay. This feature is available with Postfix version 2.2.

+CA. Otherwise, clients with a third-party certificate would also
+be allowed to relay.  Specify "tls_append_default_CA = no" when the
+trusted CA is specified with smtpd_tls_CAfile or smtpd_tls_CApath,
+to prevent Postfix from appending the system-supplied default CAs.
+This feature is available with Postfix version 2.2.
 
 
permit_tls_clientcerts

 
@@ -8648,6 +8651,10 @@ file may also be used to augment the server certificate trust chain,
 but it is best to include all the required certificates directly in the
 server certificate file. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. 

+
 
 By default (see smtpd_tls_ask_ccert), client certificates are not
 requested, and smtpd_tls_CAfile should remain empty. If you do make use
 of client certificates, the distinguished names (DNs) of the certificate
@@ -8675,6 +8682,10 @@ for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". To use
 smtpd_tls_CApath in chroot mode, this directory (or a copy) must be
 inside the chroot jail. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. 

+
 
 By default (see smtpd_tls_ask_ccert), client certificates are
 not requested, and smtpd_tls_CApath should remain empty. In contrast
 to smtpd_tls_CAfile, DNs of certificate authorities installed
@@ -9043,6 +9054,10 @@ file may also be used to augment the client certificate trust chain,
 but it is best to include all the required certificates directly in
 $smtp_tls_cert_file. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. 

+
 
 Example: 

 
 
@@ -9062,6 +9077,10 @@ with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs".
 
 To use this option in chroot mode, this directory (or a copy) 
 must be inside the chroot jail. 

 
+
 Specify "tls_append_default_CA = no" to prevent Postfix from
+appending the system-supplied default CAs and trusting third-party
+certificates. 

+
 
 Example: 

 
 
@@ -9351,6 +9370,19 @@ smtp_tls_dcert_file = /etc/postfix/client-dsa.pem
 
 
 This feature is available in Postfix 2.2 and later.  

 
+%PARAM tls_append_default_CA no
+
+
 Append the system-supplied default certificate authority
+certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
+The default is "no"; this prevents Postfix from trusting third-party
+certificates and giving them relay permission with
+permit_tls_all_clientcerts.  

+
+
 This feature is available in Postfix 2.4.15, 2.6.8, 2.7.2 and
+later versions. Specify "tls_append_default_CA = yes" for backwards
+compatibility, to avoid breaking certificate verification with sites
+that don't use permit_tls_all_clientcerts. 

+
 %PARAM tls_random_exchange_name see "postconf -d" output
 
 
 Name of the pseudo random number generator (PRNG) state file
diff --git a/postfix/src/global/mail_params.h b/postfix/src/global/mail_params.h
index ac37e3e55..b4b67537d 100644
--- a/postfix/src/global/mail_params.h
+++ b/postfix/src/global/mail_params.h
@@ -623,6 +623,10 @@ extern bool var_stat_home_dir;
 #define DEF_DUP_FILTER_LIMIT	1000
 extern int var_dup_filter_limit;
 
+#define VAR_TLS_APPEND_DEF_CA	"tls_append_default_CA"
+#define DEF_TLS_APPEND_DEF_CA	0	/* Postfix < 2.8 BC break */
+extern bool var_tls_append_def_CA;
+
 #define VAR_TLS_RAND_EXCH_NAME	"tls_random_exchange_name"
 #define DEF_TLS_RAND_EXCH_NAME	"${data_directory}/prng_exch"
 extern char *var_tls_rand_exch_name;
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 198a87674..8f1e0fdc7 100644
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20100608"
-#define MAIL_VERSION_NUMBER	"2.7.1"
+#define MAIL_RELEASE_DATE	"20100615"
+#define MAIL_VERSION_NUMBER	"2.7.2-RC1"
 
 #ifdef SNAPSHOT
 # define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
diff --git a/postfix/src/tls/tls_certkey.c b/postfix/src/tls/tls_certkey.c
index 913b67e23..504c18627 100644
--- a/postfix/src/tls/tls_certkey.c
+++ b/postfix/src/tls/tls_certkey.c
@@ -70,6 +70,10 @@
 
 #include 
 
+/* Global library. */
+
+#include 
+
 /* TLS library. */
 
 #define TLS_INTERNAL
@@ -91,7 +95,7 @@ int     tls_set_ca_certificate_info(SSL_CTX *ctx, const char *CAfile,
 	    tls_print_errors();
 	    return (-1);
 	}
-	if (!SSL_CTX_set_default_verify_paths(ctx)) {
+	if (var_tls_append_def_CA && !SSL_CTX_set_default_verify_paths(ctx)) {
 	    msg_info("cannot set certificate verification paths: "
 		     "disabling TLS support");
 	    tls_print_errors();
diff --git a/postfix/src/tls/tls_misc.c b/postfix/src/tls/tls_misc.c
index 8f12fe166..c1fd1c52a 100644
--- a/postfix/src/tls/tls_misc.c
+++ b/postfix/src/tls/tls_misc.c
@@ -15,6 +15,7 @@
 /*	char	*var_tls_eecdh_strong;
 /*	char	*var_tls_eecdh_ultra;
 /*	int	var_tls_daemon_rand_bytes;
+/*	bool    var_tls_append_def_CA;
 /*
 /*	TLS_APPL_STATE *tls_alloc_app_context(ssl_ctx)
 /*	SSL_CTX	*ssl_ctx;
@@ -190,6 +191,7 @@ char   *var_tls_null_clist;
 int     var_tls_daemon_rand_bytes;
 char   *var_tls_eecdh_strong;
 char   *var_tls_eecdh_ultra;
+bool    var_tls_append_def_CA;
 
  /*
   * Index to attach TLScontext pointers to SSL objects, so that they can be
@@ -407,6 +409,10 @@ void    tls_param_init(void)
 	VAR_TLS_DAEMON_RAND_BYTES, DEF_TLS_DAEMON_RAND_BYTES, &var_tls_daemon_rand_bytes, 1, 0,
 	0,
     };
+    static const CONFIG_BOOL_TABLE bool_table[] = {
+	VAR_TLS_APPEND_DEF_CA, DEF_TLS_APPEND_DEF_CA, &var_tls_append_def_CA,
+	0,
+    };
     static int init_done;
 
     if (init_done)