git.ipfire.org Git - thirdparty/postfix.git/log

]> git.ipfire.org Git - thirdparty/postfix.git/log

projects / thirdparty / postfix.git / log

commit | commitdiff | tree

Viktor Dukhovni [Sat, 20 Aug 2016 06:11:58 +0000 (02:11 -0400)]

Bitrot: OpenSSL 1.1.0 X509_STORE_CTX is opaque

Avoid direct access to member fields, use the accessors.

commit | commitdiff | tree

Viktor Dukhovni [Sat, 20 Aug 2016 05:54:36 +0000 (01:54 -0400)]

Bitrot: OpenSSL 1.1.0 DH structure is opaque

Backport DHE code refactoring from 3.0, but keep the default DH
size at 1024 for backwards-compatible behaviour with earlier stable
2.10 releases.

commit | commitdiff | tree

Viktor Dukhovni [Sat, 20 Aug 2016 06:01:18 +0000 (02:01 -0400)]

Bitrot: More OpenSSL 1.1.0 API constification

The accessor for ASN1_STRING has a new name and now returns const
data. Deal with the fallout.

commit | commitdiff | tree

Viktor Dukhovni [Sun, 29 May 2016 17:30:14 +0000 (13:30 -0400)]

Disable reuse of ECDH ephemeral keys

commit | commitdiff | tree

Viktor Dukhovni [Sat, 19 Mar 2016 18:36:07 +0000 (14:36 -0400)]

Fix printf format warnings

commit | commitdiff | tree

Viktor Dukhovni [Sat, 19 Mar 2016 18:37:16 +0000 (14:37 -0400)]

Support Berkeley DB version 6

commit | commitdiff | tree

Viktor Dukhovni [Sat, 19 Mar 2016 18:36:47 +0000 (14:36 -0400)]

Bitrot: OpenSSL 1.1.0 requires explicit #include <openssl/dh.h>

commit | commitdiff | tree

Viktor Dukhovni [Fri, 18 Mar 2016 06:04:10 +0000 (02:04 -0400)]

Clang requires working NORETURN

commit | commitdiff | tree

Viktor Dukhovni [Mon, 15 Feb 2016 06:13:06 +0000 (01:13 -0500)]

Bitrot: auto-initialization of OpenSSL 1.1.0

The functions SSL_library_init(), SSL_load_error_strings() and
OpenSSL_add_ssl_algorithms() are deprecated in OpenSSL 1.1.0.

Instead the library auto-initializes. Though it is possible to
call OPENSSL_init_crypto() and OPENSSL_init_ssl() for explicit
control over initialization, for now there is no apparent reason
to do so. This may change, so explicit initialization might yet
become necessary.

commit | commitdiff | tree

Viktor Dukhovni [Thu, 19 Jun 2014 14:58:14 +0000 (10:58 -0400)]

Sanitize non-printables in X509_NAME_oneline output

commit | commitdiff | tree

Viktor Dukhovni [Fri, 13 Jun 2014 02:56:47 +0000 (22:56 -0400)]

Upcoming OpenSSL security levels disable "weak" crypto.

Bitrot:  OpenSSL 1.1.0-dev (aka the "master" branch) has new security
levels ranging from 0 to 5.

  * Level "0" is backwards compatible anything goes.

  * Level "1", the new default, is roughly 80-bit or greater security
    across the board (block ciphers, EDH parameters, EC curves, RSA
    bit lengths, ...).  It also disables anonymous ciphersuites,
    breaking "smtpd_tls_cert_file = none", and in is stronger than
    we want for opportunistic TLS.

  * The remaining levels are for now too strong even for mandatory
    authenticated TLS, they disable RC4, RSA keys shorter than 2048
    bits, and SSLv3.

Therefore, (subject to the presence of the feature detected via
macro recommended by Steve Henson), we revert the default security
level back to 0 in the application SSL context.  Users can if they
wish change this by appending ":@SECURITY=<n>" to the various tls
cipherlists.  TODO: we'll shold also add a main.cf parameter and
policy table overrides for this at some point, provided we can
figure out how to explain yet another "mumble_level" to the users.

When authentication is mandatory in either the SMTP client or in
the SMTP server (smtpd_tls_req_ccert = yes) we set the security
level to 1 to ensure adequately strong parameters.

When testing this, discovered that verification error reasons are
not logged in the SMTP server, cloned and tested corresponding code
from the client.

Sample logging (when client cert has wrong EKU):

    smtpd[63016]: certificate verification failed for localhost[127.0.0.1]: not designated for use as a client certificate
    smtpd[63016]: Untrusted TLS connection established from localhost[127.0.0.1]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
    smtpd[63016]: NOQUEUE: abort: TLS from localhost[127.0.0.1]: Client certificate not trusted

commit | commitdiff | tree

Viktor Dukhovni [Thu, 4 Feb 2016 09:00:27 +0000 (04:00 -0500)]

Bitrot: session_id constification in callbacks

commit | commitdiff | tree

Viktor Dukhovni [Thu, 4 Feb 2016 08:38:57 +0000 (03:38 -0500)]

Bitrot: use RSA_generate_key_ex with OpenSSL >= 1.0.0

commit | commitdiff | tree

Viktor Dukhovni [Sun, 10 Jan 2016 08:00:23 +0000 (03:00 -0500)]

Bitrot: OpenSSL 1.1.0 constification

commit | commitdiff | tree

Viktor Dukhovni [Sun, 10 Jan 2016 07:57:53 +0000 (02:57 -0500)]

Bitrot: OpenSSL 1.1.0-dev drops EXPORT ciphers and ephemeral RSA