]>
git.ipfire.org Git - thirdparty/postfix.git/log
Viktor Dukhovni [Thu, 19 Jun 2014 14:58:14 +0000 (10:58 -0400)]
Sanitize non-printables in X509_NAME_oneline output
Viktor Dukhovni [Fri, 13 Jun 2014 02:56:47 +0000 (22:56 -0400)]
Upcoming OpenSSL security levels disable "weak" crypto.
Bitrot: OpenSSL 1.1.0-dev (aka the "master" branch) has new security
levels ranging from 0 to 5.
* Level "0" is backwards compatible anything goes.
* Level "1", the new default, is roughly 80-bit or greater security
across the board (block ciphers, EDH parameters, EC curves, RSA
bit lengths, ...). It also disables anonymous ciphersuites,
breaking "smtpd_tls_cert_file = none", and in is stronger than
we want for opportunistic TLS.
* The remaining levels are for now too strong even for mandatory
authenticated TLS, they disable RC4, RSA keys shorter than 2048
bits, and SSLv3.
Therefore, (subject to the presence of the feature detected via
macro recommended by Steve Henson), we revert the default security
level back to 0 in the application SSL context. Users can if they
wish change this by appending ":@SECURITY=<n>" to the various tls
cipherlists. TODO: we'll shold also add a main.cf parameter and
policy table overrides for this at some point, provided we can
figure out how to explain yet another "mumble_level" to the users.
When authentication is mandatory in either the SMTP client or in
the SMTP server (smtpd_tls_req_ccert = yes) we set the security
level to 1 to ensure adequately strong parameters.
When testing this, discovered that verification error reasons are
not logged in the SMTP server, cloned and tested corresponding code
from the client.
Sample logging (when client cert has wrong EKU):
smtpd[63016]: certificate verification failed for localhost[127.0.0.1]: not designated for use as a client certificate
smtpd[63016]: Untrusted TLS connection established from localhost[127.0.0.1]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
smtpd[63016]: NOQUEUE: abort: TLS from localhost[127.0.0.1]: Client certificate not trusted
Wietse Venema [Wed, 18 Jun 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sat, 31 May 2014 05:00:00 +0000 (00:00 -0500)]
Viktor Dukhovni [Sat, 31 May 2014 04:27:49 +0000 (00:27 -0400)]
Ignore more compiler artifacts
Wietse Venema [Fri, 30 May 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sat, 24 May 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 16 May 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Thu, 8 May 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Wed, 7 May 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 6 Apr 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 21 Mar 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Tue, 18 Mar 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 16 Mar 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 23 Feb 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Wed, 19 Feb 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 9 Feb 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Wed, 15 Jan 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Thu, 9 Jan 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 5 Jan 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sat, 4 Jan 2014 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sat, 28 Dec 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sat, 21 Dec 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 20 Dec 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Wed, 18 Dec 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Tue, 17 Dec 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Tue, 26 Nov 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 22 Nov 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Thu, 21 Nov 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Wed, 20 Nov 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Tue, 19 Nov 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Mon, 18 Nov 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 17 Nov 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Thu, 14 Nov 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Tue, 5 Nov 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Mon, 4 Nov 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 3 Nov 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sat, 2 Nov 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 1 Nov 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Thu, 31 Oct 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Tue, 1 Oct 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 29 Sep 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sat, 28 Sep 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 27 Sep 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 25 Aug 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 18 Aug 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Wed, 10 Jul 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Tue, 9 Jul 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 23 Jun 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 16 Jun 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Tue, 11 Jun 2013 04:17:07 +0000 (00:17 -0400)]
Wietse Venema [Sat, 8 Jun 2013 04:44:29 +0000 (00:44 -0400)]
Wietse Venema [Fri, 7 Jun 2013 17:01:40 +0000 (13:01 -0400)]
Viktor Dukhovni [Wed, 5 Jun 2013 15:38:37 +0000 (11:38 -0400)]
Ignore posttls-finger binary
Wietse Venema [Sun, 2 Jun 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 17 May 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Mon, 13 May 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 12 May 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 5 Apr 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Wed, 3 Apr 2013 05:00:00 +0000 (00:00 -0500)]
Viktor Dukhovni [Mon, 1 Apr 2013 03:04:44 +0000 (23:04 -0400)]
MacOSX needs libresolv at least since 10.8, probably much longer ago.
Wietse Venema [Sun, 31 Mar 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Wed, 27 Mar 2013 01:44:46 +0000 (21:44 -0400)]
Wietse Venema [Tue, 26 Mar 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Mon, 25 Mar 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 24 Mar 2013 05:00:00 +0000 (00:00 -0500)]
Viktor Dukhovni [Fri, 22 Mar 2013 17:24:44 +0000 (13:24 -0400)]
More .gitignore files.
Wietse Venema [Tue, 19 Mar 2013 02:12:26 +0000 (22:12 -0400)]
Wietse Venema [Mon, 18 Mar 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 17 Mar 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sat, 16 Mar 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 15 Mar 2013 05:00:00 +0000 (00:00 -0500)]
Viktor Dukhovni [Sat, 16 Feb 2013 21:30:00 +0000 (16:30 -0500)]
github boilerplate
Wietse Venema [Mon, 11 Feb 2013 17:00:00 +0000 (12:00 -0500)]
Wietse Venema [Mon, 4 Feb 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 1 Feb 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 13 Jan 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Tue, 1 Jan 2013 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Thu, 27 Dec 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Wed, 26 Dec 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Mon, 24 Dec 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 21 Dec 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Mon, 10 Dec 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 23 Nov 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Wed, 31 Oct 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Mon, 22 Oct 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 19 Oct 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 7 Oct 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Mon, 24 Sep 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sat, 8 Sep 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 2 Sep 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Wed, 1 Aug 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 15 Jul 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Fri, 13 Jul 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sat, 30 Jun 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Wed, 27 Jun 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Thu, 21 Jun 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 17 Jun 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Sun, 20 May 2012 05:00:00 +0000 (00:00 -0500)]
Wietse Venema [Thu, 26 Apr 2012 05:00:00 +0000 (00:00 -0500)]