From: Wietse Venema Date: Sat, 4 Mar 2023 05:00:00 +0000 (-0500) Subject: postfix-3.8-20230304 X-Git-Tag: v3.8.0-RC1~8 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e2ea44d47490a2ea730c4d864d65e97a4a4a4cd3;p=thirdparty%2Fpostfix.git postfix-3.8-20230304 --- diff --git a/postfix/HISTORY b/postfix/HISTORY index 5041f17cf..596c0e91f 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -26878,3 +26878,31 @@ Apologies for any names omitted. and record ordering code. Eliminated some special-case handling of zero-weight records (that was already started in the initial implementation). File: dns/dns_rr.c. + +20230224 + + Documentation fix (error introduced: Postfix 2.7): In a + "make makefiles" example in SASL_README, a backslash-newline + inside single quotes produced a broken Makefile. Problem + reported by James Brown (Bordo International). Updated "make + makefiles" examples, replacing single quotes with double + quotes, and inside those quotes replacing \" with \\\" to + protect a string-valued macro definition. Files: + proto/INSTALL.html, proto/MYSQL_README.html, + proto/PGSQL_README.html, proto/postconf.proto, + proto/SASL_README.html, proto/SQLITE_README.html. + +20230303 + + Cleanup: Postfix TLS configuration. Treat "export" and "low" + cipher grades as "medium", and ignore "export" and "low" + cipherlist settings. These grades are no longer supported + in OpenSSL 1.1.1, the minimum version that Postfix requires. + Also, update Postfix default settings to exclude the following + deprecated or unused ciphers (SEED, IDEA, 3DES, RC2, RC4, + RC5), digest (MD5), key exchange algorithms (DH, ECDH), and + public key algorithm (DSS). Viktor Dukhovni. Files: + proto/postconf.proto, global/mail_params.h, smtp/smtp.c, + smtpd/smtpd.c, tls/tls_misc.c, tls/tls_proxy_client_misc.c, + tls/tls_proxy_client_print.c, tls/tls_proxy_client_scan.c, + tls/tls_proxy.h, tlsproxy/tlsproxy.c. diff --git a/postfix/INSTALL b/postfix/INSTALL index f66b6d6c3..5939a995a 100644 --- a/postfix/INSTALL +++ b/postfix/INSTALL @@ -466,7 +466,7 @@ configuration file, except for one: the parameter that specifies the location of Postfix configuration files. In order to build Postfix with a configuration directory other than /etc/postfix, use: - $ make makefiles CCARGS='-DDEF_CONFIG_DIR=\"/some/where\"' + $ make makefiles CCARGS="-DDEF_CONFIG_DIR=\\\"/some/where\\\"" $ make IMPORTANT: Be sure to get the quotes right. These details matter a lot. diff --git a/postfix/README_FILES/INSTALL b/postfix/README_FILES/INSTALL index 7a4a4f862..09d0f803e 100644 --- a/postfix/README_FILES/INSTALL +++ b/postfix/README_FILES/INSTALL @@ -466,7 +466,7 @@ configuration file, except for one: the parameter that specifies the location of Postfix configuration files. In order to build Postfix with a configuration directory other than /etc/postfix, use: - $ make makefiles CCARGS='-DDEF_CONFIG_DIR=\"/some/where\"' + $ make makefiles CCARGS="-DDEF_CONFIG_DIR=\\\"/some/where\\\"" $ make IMPORTANT: Be sure to get the quotes right. These details matter a lot. diff --git a/postfix/README_FILES/MYSQL_README b/postfix/README_FILES/MYSQL_README index 5a728fb06..17699230a 100644 --- a/postfix/README_FILES/MYSQL_README +++ b/postfix/README_FILES/MYSQL_README @@ -35,8 +35,8 @@ DHAS_MYSQL and -I for the directory containing the mysql headers, and the mysqlclient library (and libm) to AUXLIBS_MYSQL, for example: make -f Makefile.init makefiles \ - 'CCARGS=-DHAS_MYSQL -I/usr/local/mysql/include' \ - 'AUXLIBS_MYSQL=-L/usr/local/mysql/lib -lmysqlclient -lz -lm' + "CCARGS=-DHAS_MYSQL -I/usr/local/mysql/include" \ + "AUXLIBS_MYSQL=-L/usr/local/mysql/lib -lmysqlclient -lz -lm" If your MySQL shared library is in a directory that the RUN-TIME linker does not know about, add a "-Wl,-R,/path/to/directory" option after "-lmysqlclient". @@ -54,9 +54,9 @@ building a dynamically-loaded or statically-loaded MySQL database client. On Solaris, use this instead: make -f Makefile.init makefiles \ - 'CCARGS=-DHAS_MYSQL -I/usr/local/mysql/include' \ - 'AUXLIBS_MYSQL=-L/usr/local/mysql/lib -R/usr/local/mysql/lib \ - -lmysqlclient -lz -lm' + "CCARGS=-DHAS_MYSQL -I/usr/local/mysql/include" \ + "AUXLIBS_MYSQL=-L/usr/local/mysql/lib -R/usr/local/mysql/lib \ + -lmysqlclient -lz -lm" Then, just run 'make'. This requires libz, the compression library. Older mysql implementations build without libz. diff --git a/postfix/README_FILES/PGSQL_README b/postfix/README_FILES/PGSQL_README index ae9c3bff5..f68536c36 100644 --- a/postfix/README_FILES/PGSQL_README +++ b/postfix/README_FILES/PGSQL_README @@ -33,8 +33,8 @@ For example: % make tidy % make -f Makefile.init makefiles \ - 'CCARGS=-DHAS_PGSQL -I/usr/local/include/pgsql' \ - 'AUXLIBS_PGSQL=-L/usr/local/lib -lpq' + "CCARGS=-DHAS_PGSQL -I/usr/local/include/pgsql" \ + "AUXLIBS_PGSQL=-L/usr/local/lib -lpq" If your PostgreSQL shared library is in a directory that the RUN-TIME linker does not know about, add a "-Wl,-R,/path/to/directory" option after "-lpq". diff --git a/postfix/README_FILES/SASL_README b/postfix/README_FILES/SASL_README index 4ea62d9b3..83c0b297f 100644 --- a/postfix/README_FILES/SASL_README +++ b/postfix/README_FILES/SASL_README @@ -1299,14 +1299,14 @@ To generate the necessary Makefiles, execute the following in the Postfix top- level directory: % mmaakkee ttiiddyy # if you have left-over files from a previous build - % mmaakkee mmaakkeeffiilleess CCCCAARRGGSS==''--DDUUSSEE__SSAASSLL__AAUUTTHH \\ - --DDDDEEFF__SSEERRVVEERR__SSAASSLL__TTYYPPEE==\\""ddoovveeccoott\\""'' + % mmaakkee mmaakkeeffiilleess CCCCAARRGGSS==""--DDUUSSEE__SSAASSLL__AAUUTTHH \\ + --DDDDEEFF__SSEERRVVEERR__SSAASSLL__TTYYPPEE==\\\\\\""ddoovveeccoott\\\\\\"""" After this, proceed with "make" as described in the INSTALL document. NNoottee - * The -DDEF_SERVER_SASL_TYPE=\"dovecot\" is not necessary; it just makes + * The -DDEF_SERVER_SASL_TYPE=\\\"dovecot\\\" is not necessary; it just makes Postfix configuration a little more convenient because you don't have to specify the SASL plug-in type in the Postfix main.cf file (but this may cause surprises when you switch to a later Postfix version that is built @@ -1317,10 +1317,10 @@ NNoottee LDAP_README and TLS_README for details. % mmaakkee ttiiddyy # if you have left-over files from a previous build - % mmaakkee mmaakkeeffiilleess CCCCAARRGGSS==''--DDUUSSEE__SSAASSLL__AAUUTTHH \\ - --DDDDEEFF__SSEERRVVEERR__SSAASSLL__TTYYPPEE==\\""ddoovveeccoott\\"" \\ - ......CCCCAARRGGSS ooppttiioonnss ffoorr LLDDAAPP oorr TTLLSS eettcc........'' \\ - AAUUXXLLIIBBSS==''......AAUUXXLLIIBBSS ooppttiioonnss ffoorr LLDDAAPP oorr TTLLSS eettcc........'' + % mmaakkee mmaakkeeffiilleess CCCCAARRGGSS==""--DDUUSSEE__SSAASSLL__AAUUTTHH \\ + --DDDDEEFF__SSEERRVVEERR__SSAASSLL__TTYYPPEE==\\\\\\""ddoovveeccoott\\\\\\"" \\ + ......CCCCAARRGGSS ooppttiioonnss ffoorr LLDDAAPP oorr TTLLSS eettcc........"" \\ + AAUUXXLLIIBBSS==""......AAUUXXLLIIBBSS ooppttiioonnss ffoorr LLDDAAPP oorr TTLLSS eettcc........"" BBuuiillddiinngg CCyyrruuss SSAASSLL ssuuppppoorrtt diff --git a/postfix/README_FILES/SQLITE_README b/postfix/README_FILES/SQLITE_README index 7f668dea4..f4e98f931 100644 --- a/postfix/README_FILES/SQLITE_README +++ b/postfix/README_FILES/SQLITE_README @@ -23,8 +23,8 @@ sqlite3 library, plus the name of the standard POSIX thread library (pthread). For example: make -f Makefile.init makefiles \ - 'CCARGS=-DHAS_SQLITE -I/usr/local/include' \ - 'AUXLIBS_SQLITE=-L/usr/local/lib -lsqlite3 -lpthread' + "CCARGS=-DHAS_SQLITE -I/usr/local/include" \ + "AUXLIBS_SQLITE=-L/usr/local/lib -lsqlite3 -lpthread" If your SQLite shared library is in a directory that the RUN-TIME linker does not know about, add a "-Wl,-R,/path/to/directory" option after "-lsqlite3". diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index 3bc391d8b..7d3b537bc 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -25,24 +25,20 @@ more recent Eclipse Public License 2.0. Recipients can choose to take the software under the license of their choice. Those who are more comfortable with the IPL can continue with that license. -Bugfix for messages not delivered after "warning: Unexpected record type 'X' -============================================================================ - -Due to a bug introduced in Postfix 3.7.0, a message could falsely -be flagged as corrupt with "warning: Unexpected record type 'X'". +Incompatible changes with snapshot 20221228 +=========================================== -Such messages were moved to the "corrupt" queue directory, where -they may still be found. See below for instructions to deal with -these falsely flagged messages. +This introduces the following changes in Postfix TLS support: -This problem could happen for messages with 5000 or more recipients, -or with fewer recipients on a busy mail server. The problem was -first reported by Frank Brendel, and the error conditions were -reproduced by John Alex. +- Postfix ignores "export" and "low" cipher list settings, and + treats the "export" and "low" cipher grade settings as "medium". + These grades are no longer supported in OpenSSL 1.1.1, the minimum + version that Postfix requires. -Please see https://www.postfix.org/announcements/postfix-3.7.3 for -instructions to identify falsely flagged messages in the Postfix -queue, and what actions may be taken. +- Postfix default settings now exclude the following deprecated or + unused ciphers (SEED, IDEA, 3DES, RC2, RC4, RC5), digest (MD5), + key exchange algorithms (DH, ECDH), and public key algorithm + (DSS). Incompatible changes with snapshot 20221228 =========================================== diff --git a/postfix/html/INSTALL.html b/postfix/html/INSTALL.html index f7386fdca..549c04d23 100644 --- a/postfix/html/INSTALL.html +++ b/postfix/html/INSTALL.html @@ -710,7 +710,7 @@ use: 

-$ make makefiles CCARGS='-DDEF_CONFIG_DIR=\"/some/where\"'
+$ make makefiles CCARGS="-DDEF_CONFIG_DIR=\\\"/some/where\\\""
 $ make
diff --git a/postfix/html/MYSQL_README.html b/postfix/html/MYSQL_README.html index 147802f0d..b6eee16b2 100644 --- a/postfix/html/MYSQL_README.html +++ b/postfix/html/MYSQL_README.html @@ -56,8 +56,8 @@ the mysqlclient library (and libm) to AUXLIBS_MYSQL< 
 make -f Makefile.init makefiles \
-    'CCARGS=-DHAS_MYSQL -I/usr/local/mysql/include' \
-    'AUXLIBS_MYSQL=-L/usr/local/mysql/lib -lmysqlclient -lz -lm'
+    "CCARGS=-DHAS_MYSQL -I/usr/local/mysql/include" \
+    "AUXLIBS_MYSQL=-L/usr/local/mysql/lib -lmysqlclient -lz -lm"
@@ -85,9 +85,9 @@ what dynamic database client loading was meant to avoid. 

 make -f Makefile.init makefiles \
-    'CCARGS=-DHAS_MYSQL -I/usr/local/mysql/include' \
-    'AUXLIBS_MYSQL=-L/usr/local/mysql/lib -R/usr/local/mysql/lib \
-        -lmysqlclient -lz -lm'
+    "CCARGS=-DHAS_MYSQL -I/usr/local/mysql/include" \
+    "AUXLIBS_MYSQL=-L/usr/local/mysql/lib -R/usr/local/mysql/lib \
+        -lmysqlclient -lz -lm"
diff --git a/postfix/html/PGSQL_README.html b/postfix/html/PGSQL_README.html index 98741395a..1699855c1 100644 --- a/postfix/html/PGSQL_README.html +++ b/postfix/html/PGSQL_README.html @@ -52,8 +52,8 @@ the location of the libpq library file. 

 % make tidy
 % make -f Makefile.init makefiles \
-        'CCARGS=-DHAS_PGSQL -I/usr/local/include/pgsql' \
-        'AUXLIBS_PGSQL=-L/usr/local/lib -lpq'
+        "CCARGS=-DHAS_PGSQL -I/usr/local/include/pgsql" \
+        "AUXLIBS_PGSQL=-L/usr/local/lib -lpq"
diff --git a/postfix/html/SASL_README.html b/postfix/html/SASL_README.html index 1ddd24bb2..cdc9f8883 100644 --- a/postfix/html/SASL_README.html +++ b/postfix/html/SASL_README.html @@ -2044,8 +2044,8 @@ the Postfix top-level directory: 

 % make tidy # if you have left-over files from a previous build
-% make makefiles CCARGS='-DUSE_SASL_AUTH \
-    -DDEF_SERVER_SASL_TYPE=\"dovecot\"'
+% make makefiles CCARGS="-DUSE_SASL_AUTH \
+    -DDEF_SERVER_SASL_TYPE=\\\"dovecot\\\""
@@ -2058,7 +2058,7 @@ the INSTALL document.

  • -

    The -DDEF_SERVER_SASL_TYPE=\"dovecot\" is not +

    The -DDEF_SERVER_SASL_TYPE=\\\"dovecot\\\" is not necessary; it just makes Postfix configuration a little more convenient because you don't have to specify the SASL plug-in type in the Postfix main.cf file (but this may cause surprises when you @@ -2077,10 +2077,10 @@ options into the above command line; see the LDAP_REA 

     % make tidy # if you have left-over files from a previous build
-% make makefiles CCARGS='-DUSE_SASL_AUTH \
-    -DDEF_SERVER_SASL_TYPE=\"dovecot\" \
-    ...CCARGS options for LDAP or TLS etc....' \
-   AUXLIBS='...AUXLIBS options for LDAP or TLS etc....'
+% make makefiles CCARGS="-DUSE_SASL_AUTH \
+    -DDEF_SERVER_SASL_TYPE=\\\"dovecot\\\" \
+    ...CCARGS options for LDAP or TLS etc...." \
+   AUXLIBS="...AUXLIBS options for LDAP or TLS etc...."
    diff --git a/postfix/html/SQLITE_README.html b/postfix/html/SQLITE_README.html index bc91e5fdc..806b7da3c 100644 --- a/postfix/html/SQLITE_README.html +++ b/postfix/html/SQLITE_README.html @@ -43,8 +43,8 @@ name of the standard POSIX thread library (pthread). For example: 
     make -f Makefile.init makefiles \
-     'CCARGS=-DHAS_SQLITE -I/usr/local/include' \
-     'AUXLIBS_SQLITE=-L/usr/local/lib -lsqlite3 -lpthread'
+     "CCARGS=-DHAS_SQLITE -I/usr/local/include" \
+     "AUXLIBS_SQLITE=-L/usr/local/lib -lsqlite3 -lpthread"
    diff --git a/postfix/html/lmtp.8.html b/postfix/html/lmtp.8.html index 696d3bf4c..506864769 100644 --- a/postfix/html/lmtp.8.html +++ b/postfix/html/lmtp.8.html @@ -404,11 +404,11 @@ SMTP(8) SMTP(8) ignore_srv_lookup_error (no) When SRV record lookup fails, fall back to MX or IP address - lookup as if SRV record lookups were not enabled. + lookup as if SRV record lookup was not enabled. allow_srv_lookup_fallback (no) When SRV record lookup fails or no SRV record exists, fall back - to MX or IP address lookup as if SRV record lookups were not + to MX or IP address lookup as if SRV record lookup was not enabled. MIME PROCESSING CONTROLS @@ -585,16 +585,18 @@ SMTP(8) SMTP(8) tls_medium_cipherlist (see 'postconf -d' output) The OpenSSL cipherlist for "medium" or higher grade ciphers. + tls_null_cipherlist (eNULL:!aNULL) + The OpenSSL cipherlist for "NULL" grade ciphers that provide + authentication without encryption. + + Available in in Postfix version 2.3..3.7: + tls_low_cipherlist (see 'postconf -d' output) The OpenSSL cipherlist for "low" or higher grade ciphers. tls_export_cipherlist (see 'postconf -d' output) The OpenSSL cipherlist for "export" or higher grade ciphers. - tls_null_cipherlist (eNULL:!aNULL) - The OpenSSL cipherlist for "NULL" grade ciphers that provide - authentication without encryption. - Available in Postfix version 2.4 and later: smtp_sasl_tls_verified_security_options ($smtp_sasl_tls_secu- diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html index 722bdc4ec..cb2c8a5c8 100644 --- a/postfix/html/postconf.5.html +++ b/postfix/html/postconf.5.html @@ -4034,7 +4034,7 @@ mis-delivery of mail. (default: no)

    When SRV record lookup fails, fall back to MX or IP address -lookup as if SRV record lookup was not enabled. +lookup as if SRV record lookup was not enabled.

    This feature is available in Postfix 3.8 and later.

    @@ -13290,24 +13290,6 @@ on a per-destination basis.

    The following cipher grades are supported:

    -
    export
    -
    Enable "EXPORT" grade or better OpenSSL ciphers. The underlying -cipherlist is specified via the tls_export_cipherlist configuration -parameter, which you are strongly encouraged not to change. This -choice is insecure and SHOULD NOT be used.
    - -
    low
    -
    Enable "LOW" grade or better OpenSSL ciphers. The underlying -cipherlist is specified via the tls_low_cipherlist configuration -parameter, which you are strongly encouraged not to change. This -choice is insecure and SHOULD NOT be used.
    - -
    medium
    -
    Enable "MEDIUM" grade or better OpenSSL ciphers. -The underlying cipherlist is specified via the tls_medium_cipherlist -configuration parameter, which you are strongly encouraged not to change. -
    -
    high
    Enable only "HIGH" grade OpenSSL ciphers. This setting may be appropriate when all mandatory TLS destinations (e.g. when all @@ -13316,6 +13298,12 @@ mail is routed to a suitably capable relayho tls_high_cipherlist configuration parameter, which you are strongly encouraged not to change.
    +
    medium
    +
    Enable "MEDIUM" grade or better OpenSSL ciphers. +The underlying cipherlist is specified via the tls_medium_cipherlist +configuration parameter, which you are strongly encouraged not to change. +
    +
    null
    Enable only the "NULL" OpenSSL ciphers, these provide authentication without encryption. This setting is only appropriate in the rare case @@ -13326,6 +13314,24 @@ underlying cipherlist is specified via the tls_low_cipherlist configuration parameter, which you are +strongly encouraged not to change. This obsolete cipher grade +SHOULD NOT be used.
    + +
    export
    +
    Enable "EXPORT" grade or stronger OpenSSL ciphers. In Postfix +≥ 3.8 this cipher grade is always identical to "medium". Recent +versions of OpenSSL do not support any "EXPORT" grade ciphers. In +earlier Postfix releases the underlying cipherlist was specified +via the tls_export_cipherlist configuration parameter, which you are +strongly encouraged not to change. This obsolete cipher grade +SHOULD NOT be used.
    +

    The underlying cipherlists for grades other than "null" include @@ -18275,17 +18281,11 @@ one "medium" or "high" grade cipher.

    The following cipher grades are supported:

    -
    export
    -
    Enable "EXPORT" grade or stronger OpenSSL ciphers. The -underlying cipherlist is specified via the tls_export_cipherlist -configuration parameter, which you are strongly encouraged not to -change. This choice is insecure and SHOULD NOT be used.
    - -
    low
    -
    Enable "LOW" grade or stronger OpenSSL ciphers. The underlying -cipherlist is specified via the tls_low_cipherlist configuration -parameter, which you are strongly encouraged not to change. This -choice is insecure and SHOULD NOT be used.
    +
    high
    +
    Enable only "HIGH" grade OpenSSL ciphers. The +underlying cipherlist is specified via the tls_high_cipherlist +configuration parameter, which you are strongly encouraged to +not change.
    medium
    Enable "MEDIUM" grade or stronger OpenSSL ciphers. These use 128-bit @@ -18294,12 +18294,6 @@ strength for mandatory TLS encryption. The underlying cipherlist is specified via the tls_medium_cipherlist configuration parameter, which you are strongly encouraged not to change.
    -
    high
    -
    Enable only "HIGH" grade OpenSSL ciphers. The -underlying cipherlist is specified via the tls_high_cipherlist -configuration parameter, which you are strongly encouraged to -not change.
    -
    null
    Enable only the "NULL" OpenSSL ciphers, these provide authentication without encryption. This setting is only appropriate in the rare @@ -18308,6 +18302,24 @@ enabled in TLS clients). The underlying cipherlist is specified via the tls_null_cipherlist configuration parameter, which you are strongly encouraged not to change.
    +
    low
    +
    Enable "LOW" grade or stronger OpenSSL ciphers. In Postfix +≥ 3.8 this cipher grade is always identical to "medium". Recent +versions of OpenSSL do not support any "LOW" grade ciphers. In +earlier Postfix releases the underlying cipherlist was specified +via the tls_low_cipherlist configuration parameter, which you are +strongly encouraged not to change. This obsolete cipher grade +SHOULD NOT be used.
    + +
    export
    +
    Enable "EXPORT" grade or stronger OpenSSL ciphers. In Postfix +≥ 3.8 this cipher grade is always identical to "medium". Recent +versions of OpenSSL do not support any "EXPORT" grade ciphers. In +earlier Postfix releases the underlying cipherlist was specified +via the tls_export_cipherlist configuration parameter, which you are +strongly encouraged not to change. This obsolete cipher grade +SHOULD NOT be used.
    +

    Cipher types listed in @@ -19379,16 +19391,15 @@ EC algorithms have not been disabled by the vendor.

    tls_export_cipherlist (default: see "postconf -d" output)
    -

    The OpenSSL cipherlist for "export" or higher grade ciphers. This -defines the meaning of the "export" setting in smtpd_tls_ciphers, -smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers, -lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. With Postfix -releases before the middle of 2015 this is the default cipherlist -for the opportunistic ("may") TLS client security level and also -the default cipherlist for the SMTP server. You are strongly -encouraged not to change this setting.

    +

    The OpenSSL cipherlist for "export" or higher grade ciphers. +Ignored as of Postfix 3.8. In earlier Postfix releases this +defined the meaning of the "export" setting in smtpd_tls_ciphers, +smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, +smtp_tls_mandatory_ciphers, lmtp_tls_ciphers, and +lmtp_tls_mandatory_ciphers. You are strongly encouraged not to +change this setting.

    -

    This feature is available in Postfix 2.3 and later.

    +

    This feature is available in Postfix 2.3 and later.

    @@ -19484,13 +19495,15 @@ certificate public-key fingerprints, see TLS_READMEtls_low_cipherlist (default: see "postconf -d" output)
    -

    The OpenSSL cipherlist for "low" or higher grade ciphers. This defines -the meaning of the "low" setting in smtpd_tls_ciphers, -smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers, -lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. You are strongly -encouraged not to change this setting.

    +

    The OpenSSL cipherlist for "low" or higher grade ciphers. +Ignored as of Postfix 3.8. In earlier Postfix releases this +defined the meaning of the "low" setting in smtpd_tls_ciphers, +smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, +smtp_tls_mandatory_ciphers, lmtp_tls_ciphers, and +lmtp_tls_mandatory_ciphers. You are strongly encouraged not to +change this setting.

    -

    This feature is available in Postfix 2.3 and later.

    +

    This feature is available in Postfix 2.3 and later.

    diff --git a/postfix/html/smtp.8.html b/postfix/html/smtp.8.html index 696d3bf4c..506864769 100644 --- a/postfix/html/smtp.8.html +++ b/postfix/html/smtp.8.html @@ -404,11 +404,11 @@ SMTP(8) SMTP(8) ignore_srv_lookup_error (no) When SRV record lookup fails, fall back to MX or IP address - lookup as if SRV record lookups were not enabled. + lookup as if SRV record lookup was not enabled. allow_srv_lookup_fallback (no) When SRV record lookup fails or no SRV record exists, fall back - to MX or IP address lookup as if SRV record lookups were not + to MX or IP address lookup as if SRV record lookup was not enabled. MIME PROCESSING CONTROLS @@ -585,16 +585,18 @@ SMTP(8) SMTP(8) tls_medium_cipherlist (see 'postconf -d' output) The OpenSSL cipherlist for "medium" or higher grade ciphers. + tls_null_cipherlist (eNULL:!aNULL) + The OpenSSL cipherlist for "NULL" grade ciphers that provide + authentication without encryption. + + Available in in Postfix version 2.3..3.7: + tls_low_cipherlist (see 'postconf -d' output) The OpenSSL cipherlist for "low" or higher grade ciphers. tls_export_cipherlist (see 'postconf -d' output) The OpenSSL cipherlist for "export" or higher grade ciphers. - tls_null_cipherlist (eNULL:!aNULL) - The OpenSSL cipherlist for "NULL" grade ciphers that provide - authentication without encryption. - Available in Postfix version 2.4 and later: smtp_sasl_tls_verified_security_options ($smtp_sasl_tls_secu- diff --git a/postfix/html/smtpd.8.html b/postfix/html/smtpd.8.html index f60ee85d0..796e75297 100644 --- a/postfix/html/smtpd.8.html +++ b/postfix/html/smtpd.8.html @@ -537,16 +537,18 @@ SMTPD(8) SMTPD(8) tls_medium_cipherlist (see 'postconf -d' output) The OpenSSL cipherlist for "medium" or higher grade ciphers. + tls_null_cipherlist (eNULL:!aNULL) + The OpenSSL cipherlist for "NULL" grade ciphers that provide + authentication without encryption. + + Available in Postfix version 2.3..3.7: + tls_low_cipherlist (see 'postconf -d' output) The OpenSSL cipherlist for "low" or higher grade ciphers. tls_export_cipherlist (see 'postconf -d' output) The OpenSSL cipherlist for "export" or higher grade ciphers. - tls_null_cipherlist (eNULL:!aNULL) - The OpenSSL cipherlist for "NULL" grade ciphers that provide - authentication without encryption. - Available in Postfix version 2.5 and later: smtpd_tls_fingerprint_digest (see 'postconf -d' output) diff --git a/postfix/html/tlsproxy.8.html b/postfix/html/tlsproxy.8.html index 563ee3dbe..121ddc3bc 100644 --- a/postfix/html/tlsproxy.8.html +++ b/postfix/html/tlsproxy.8.html @@ -75,12 +75,6 @@ TLSPROXY(8) TLSPROXY(8) tls_medium_cipherlist (see 'postconf -d' output) The OpenSSL cipherlist for "medium" or higher grade ciphers. - tls_low_cipherlist (see 'postconf -d' output) - The OpenSSL cipherlist for "low" or higher grade ciphers. - - tls_export_cipherlist (see 'postconf -d' output) - The OpenSSL cipherlist for "export" or higher grade ciphers. - tls_null_cipherlist (eNULL:!aNULL) The OpenSSL cipherlist for "NULL" grade ciphers that provide authentication without encryption. @@ -101,6 +95,14 @@ TLSPROXY(8) TLSPROXY(8) erence order instead of the remote client's cipher preference order. + Available in Postfix version 2.8..3.7: + + tls_low_cipherlist (see 'postconf -d' output) + The OpenSSL cipherlist for "low" or higher grade ciphers. + + tls_export_cipherlist (see 'postconf -d' output) + The OpenSSL cipherlist for "export" or higher grade ciphers. + Available in Postfix version 2.9 and later: tls_legacy_public_key_fingerprints (no) diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5 index 3eeb9388f..38fabbb23 100644 --- a/postfix/man/man5/postconf.5 +++ b/postfix/man/man5/postconf.5 @@ -2550,7 +2550,7 @@ lookup instead. This violates the SMTP standard and can result in mis\-delivery of mail. .SH ignore_srv_lookup_error (default: no) When SRV record lookup fails, fall back to MX or IP address -lookup as if SRV record lookup was not enabled. +lookup as if SRV record lookup was not enabled. .PP This feature is available in Postfix 3.8 and later. .SH import_environment (default: see "postconf \-d" output) @@ -8759,23 +8759,6 @@ smtp_tls_policy_maps for information on how to configure ciphers on a per\-destination basis. .PP The following cipher grades are supported: -.IP "\fBexport\fR" -Enable "EXPORT" grade or better OpenSSL ciphers. The underlying -cipherlist is specified via the tls_export_cipherlist configuration -parameter, which you are strongly encouraged not to change. This -choice is insecure and SHOULD NOT be used. -.br -.IP "\fBlow\fR" -Enable "LOW" grade or better OpenSSL ciphers. The underlying -cipherlist is specified via the tls_low_cipherlist configuration -parameter, which you are strongly encouraged not to change. This -choice is insecure and SHOULD NOT be used. -.br -.IP "\fBmedium\fR" -Enable "MEDIUM" grade or better OpenSSL ciphers. -The underlying cipherlist is specified via the tls_medium_cipherlist -configuration parameter, which you are strongly encouraged not to change. -.br .IP "\fBhigh\fR" Enable only "HIGH" grade OpenSSL ciphers. This setting may be appropriate when all mandatory TLS destinations (e.g. when all @@ -8784,6 +8767,11 @@ mail is routed to a suitably capable relayhost) support at least one tls_high_cipherlist configuration parameter, which you are strongly encouraged not to change. .br +.IP "\fBmedium\fR" +Enable "MEDIUM" grade or better OpenSSL ciphers. +The underlying cipherlist is specified via the tls_medium_cipherlist +configuration parameter, which you are strongly encouraged not to change. +.br .IP "\fBnull\fR" Enable only the "NULL" OpenSSL ciphers, these provide authentication without encryption. This setting is only appropriate in the rare case @@ -8794,6 +8782,24 @@ underlying cipherlist is specified via the tls_null_cipherlist configuration parameter, which you are strongly encouraged not to change. .br +.IP "\fBlow\fR" +Enable "LOW" grade or stronger OpenSSL ciphers. In Postfix +>= 3.8 this cipher grade is always identical to "medium". Recent +versions of OpenSSL do not support any "LOW" grade ciphers. In +earlier Postfix releases the underlying cipherlist was specified +via the tls_low_cipherlist configuration parameter, which you are +strongly encouraged not to change. This obsolete cipher grade +SHOULD NOT be used. +.br +.IP "\fBexport\fR" +Enable "EXPORT" grade or stronger OpenSSL ciphers. In Postfix +>= 3.8 this cipher grade is always identical to "medium". Recent +versions of OpenSSL do not support any "EXPORT" grade ciphers. In +earlier Postfix releases the underlying cipherlist was specified +via the tls_export_cipherlist configuration parameter, which you are +strongly encouraged not to change. This obsolete cipher grade +SHOULD NOT be used. +.br .br .PP The underlying cipherlists for grades other than "null" include @@ -12887,17 +12893,11 @@ obsolete browsers. No known SMTP clients fail to support at least one "medium" or "high" grade cipher. .PP The following cipher grades are supported: -.IP "\fBexport\fR" -Enable "EXPORT" grade or stronger OpenSSL ciphers. The -underlying cipherlist is specified via the tls_export_cipherlist -configuration parameter, which you are strongly encouraged not to -change. This choice is insecure and SHOULD NOT be used. -.br -.IP "\fBlow\fR" -Enable "LOW" grade or stronger OpenSSL ciphers. The underlying -cipherlist is specified via the tls_low_cipherlist configuration -parameter, which you are strongly encouraged not to change. This -choice is insecure and SHOULD NOT be used. +.IP "\fBhigh\fR" +Enable only "HIGH" grade OpenSSL ciphers. The +underlying cipherlist is specified via the tls_high_cipherlist +configuration parameter, which you are strongly encouraged to +not change. .br .IP "\fBmedium\fR" Enable "MEDIUM" grade or stronger OpenSSL ciphers. These use 128\-bit @@ -12906,12 +12906,6 @@ strength for mandatory TLS encryption. The underlying cipherlist is specified via the tls_medium_cipherlist configuration parameter, which you are strongly encouraged not to change. .br -.IP "\fBhigh\fR" -Enable only "HIGH" grade OpenSSL ciphers. The -underlying cipherlist is specified via the tls_high_cipherlist -configuration parameter, which you are strongly encouraged to -not change. -.br .IP "\fBnull\fR" Enable only the "NULL" OpenSSL ciphers, these provide authentication without encryption. This setting is only appropriate in the rare @@ -12920,6 +12914,24 @@ enabled in TLS clients). The underlying cipherlist is specified via the tls_null_cipherlist configuration parameter, which you are strongly encouraged not to change. .br +.IP "\fBlow\fR" +Enable "LOW" grade or stronger OpenSSL ciphers. In Postfix +>= 3.8 this cipher grade is always identical to "medium". Recent +versions of OpenSSL do not support any "LOW" grade ciphers. In +earlier Postfix releases the underlying cipherlist was specified +via the tls_low_cipherlist configuration parameter, which you are +strongly encouraged not to change. This obsolete cipher grade +SHOULD NOT be used. +.br +.IP "\fBexport\fR" +Enable "EXPORT" grade or stronger OpenSSL ciphers. In Postfix +>= 3.8 this cipher grade is always identical to "medium". Recent +versions of OpenSSL do not support any "EXPORT" grade ciphers. In +earlier Postfix releases the underlying cipherlist was specified +via the tls_export_cipherlist configuration parameter, which you are +strongly encouraged not to change. This obsolete cipher grade +SHOULD NOT be used. +.br .br .PP Cipher types listed in @@ -13748,14 +13760,13 @@ This feature is available in Postfix 2.6 and later, when it is compiled and linked with OpenSSL 1.0.0 or later on platforms where EC algorithms have not been disabled by the vendor. .SH tls_export_cipherlist (default: see "postconf \-d" output) -The OpenSSL cipherlist for "export" or higher grade ciphers. This -defines the meaning of the "export" setting in smtpd_tls_ciphers, -smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers, -lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. With Postfix -releases before the middle of 2015 this is the default cipherlist -for the opportunistic ("may") TLS client security level and also -the default cipherlist for the SMTP server. You are strongly -encouraged not to change this setting. +The OpenSSL cipherlist for "export" or higher grade ciphers. +Ignored as of Postfix 3.8. In earlier Postfix releases this +defined the meaning of the "export" setting in smtpd_tls_ciphers, +smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, +smtp_tls_mandatory_ciphers, lmtp_tls_ciphers, and +lmtp_tls_mandatory_ciphers. You are strongly encouraged not to +change this setting. .PP This feature is available in Postfix 2.3 and later. .SH tls_fast_shutdown_enable (default: yes) @@ -13822,11 +13833,13 @@ certificate public\-key fingerprints, see TLS_README. .PP This feature is available in Postfix 2.9.6 and later. .SH tls_low_cipherlist (default: see "postconf \-d" output) -The OpenSSL cipherlist for "low" or higher grade ciphers. This defines -the meaning of the "low" setting in smtpd_tls_ciphers, -smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers, -lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. You are strongly -encouraged not to change this setting. +The OpenSSL cipherlist for "low" or higher grade ciphers. +Ignored as of Postfix 3.8. In earlier Postfix releases this +defined the meaning of the "low" setting in smtpd_tls_ciphers, +smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, +smtp_tls_mandatory_ciphers, lmtp_tls_ciphers, and +lmtp_tls_mandatory_ciphers. You are strongly encouraged not to +change this setting. .PP This feature is available in Postfix 2.3 and later. .SH tls_medium_cipherlist (default: see "postconf \-d" output) diff --git a/postfix/man/man8/smtp.8 b/postfix/man/man8/smtp.8 index d2a4ce9ba..8a8ad84dc 100644 --- a/postfix/man/man8/smtp.8 +++ b/postfix/man/man8/smtp.8 @@ -386,10 +386,10 @@ Enables discovery for the specified service(s) using DNS SRV records. .IP "\fBignore_srv_lookup_error (no)\fR" When SRV record lookup fails, fall back to MX or IP address -lookup as if SRV record lookups were not enabled. +lookup as if SRV record lookup was not enabled. .IP "\fBallow_srv_lookup_fallback (no)\fR" When SRV record lookup fails or no SRV record exists, fall back -to MX or IP address lookup as if SRV record lookups were not enabled. +to MX or IP address lookup as if SRV record lookup was not enabled. .SH "MIME PROCESSING CONTROLS" .na .nf @@ -540,13 +540,15 @@ internal pseudo random number generator (PRNG). The OpenSSL cipherlist for "high" grade ciphers. .IP "\fBtls_medium_cipherlist (see 'postconf -d' output)\fR" The OpenSSL cipherlist for "medium" or higher grade ciphers. +.IP "\fBtls_null_cipherlist (eNULL:!aNULL)\fR" +The OpenSSL cipherlist for "NULL" grade ciphers that provide +authentication without encryption. +.PP +Available in in Postfix version 2.3..3.7: .IP "\fBtls_low_cipherlist (see 'postconf -d' output)\fR" The OpenSSL cipherlist for "low" or higher grade ciphers. .IP "\fBtls_export_cipherlist (see 'postconf -d' output)\fR" The OpenSSL cipherlist for "export" or higher grade ciphers. -.IP "\fBtls_null_cipherlist (eNULL:!aNULL)\fR" -The OpenSSL cipherlist for "NULL" grade ciphers that provide -authentication without encryption. .PP Available in Postfix version 2.4 and later: .IP "\fBsmtp_sasl_tls_verified_security_options ($smtp_sasl_tls_security_options)\fR" diff --git a/postfix/man/man8/smtpd.8 b/postfix/man/man8/smtpd.8 index 460293901..3bfe323c6 100644 --- a/postfix/man/man8/smtpd.8 +++ b/postfix/man/man8/smtpd.8 @@ -485,13 +485,15 @@ internal pseudo random number generator (PRNG). The OpenSSL cipherlist for "high" grade ciphers. .IP "\fBtls_medium_cipherlist (see 'postconf -d' output)\fR" The OpenSSL cipherlist for "medium" or higher grade ciphers. +.IP "\fBtls_null_cipherlist (eNULL:!aNULL)\fR" +The OpenSSL cipherlist for "NULL" grade ciphers that provide +authentication without encryption. +.PP +Available in Postfix version 2.3..3.7: .IP "\fBtls_low_cipherlist (see 'postconf -d' output)\fR" The OpenSSL cipherlist for "low" or higher grade ciphers. .IP "\fBtls_export_cipherlist (see 'postconf -d' output)\fR" The OpenSSL cipherlist for "export" or higher grade ciphers. -.IP "\fBtls_null_cipherlist (eNULL:!aNULL)\fR" -The OpenSSL cipherlist for "NULL" grade ciphers that provide -authentication without encryption. .PP Available in Postfix version 2.5 and later: .IP "\fBsmtpd_tls_fingerprint_digest (see 'postconf -d' output)\fR" diff --git a/postfix/man/man8/tlsproxy.8 b/postfix/man/man8/tlsproxy.8 index 266ec1d56..77f09b8d5 100644 --- a/postfix/man/man8/tlsproxy.8 +++ b/postfix/man/man8/tlsproxy.8 @@ -90,10 +90,6 @@ internal pseudo random number generator (PRNG). The OpenSSL cipherlist for "high" grade ciphers. .IP "\fBtls_medium_cipherlist (see 'postconf -d' output)\fR" The OpenSSL cipherlist for "medium" or higher grade ciphers. -.IP "\fBtls_low_cipherlist (see 'postconf -d' output)\fR" -The OpenSSL cipherlist for "low" or higher grade ciphers. -.IP "\fBtls_export_cipherlist (see 'postconf -d' output)\fR" -The OpenSSL cipherlist for "export" or higher grade ciphers. .IP "\fBtls_null_cipherlist (eNULL:!aNULL)\fR" The OpenSSL cipherlist for "NULL" grade ciphers that provide authentication without encryption. @@ -112,6 +108,12 @@ With SSLv3 and later, use the Postfix SMTP server's cipher preference order instead of the remote client's cipher preference order. .PP +Available in Postfix version 2.8..3.7: +.IP "\fBtls_low_cipherlist (see 'postconf -d' output)\fR" +The OpenSSL cipherlist for "low" or higher grade ciphers. +.IP "\fBtls_export_cipherlist (see 'postconf -d' output)\fR" +The OpenSSL cipherlist for "export" or higher grade ciphers. +.PP Available in Postfix version 2.9 and later: .IP "\fBtls_legacy_public_key_fingerprints (no)\fR" A temporary migration aid for sites that use certificate diff --git a/postfix/proto/INSTALL.html b/postfix/proto/INSTALL.html index 36b7a05ee..9837c2489 100644 --- a/postfix/proto/INSTALL.html +++ b/postfix/proto/INSTALL.html @@ -710,7 +710,7 @@ use: 

    -$ make makefiles CCARGS='-DDEF_CONFIG_DIR=\"/some/where\"'
+$ make makefiles CCARGS="-DDEF_CONFIG_DIR=\\\"/some/where\\\""
 $ make
    diff --git a/postfix/proto/MYSQL_README.html b/postfix/proto/MYSQL_README.html index db52f02f5..91a3be8ef 100644 --- a/postfix/proto/MYSQL_README.html +++ b/postfix/proto/MYSQL_README.html @@ -56,8 +56,8 @@ the mysqlclient library (and libm) to AUXLIBS_MYSQL, for example: 

     make -f Makefile.init makefiles \
-    'CCARGS=-DHAS_MYSQL -I/usr/local/mysql/include' \
-    'AUXLIBS_MYSQL=-L/usr/local/mysql/lib -lmysqlclient -lz -lm'
+    "CCARGS=-DHAS_MYSQL -I/usr/local/mysql/include" \
+    "AUXLIBS_MYSQL=-L/usr/local/mysql/lib -lmysqlclient -lz -lm"
    @@ -85,9 +85,9 @@ what dynamic database client loading was meant to avoid. 

     make -f Makefile.init makefiles \
-    'CCARGS=-DHAS_MYSQL -I/usr/local/mysql/include' \
-    'AUXLIBS_MYSQL=-L/usr/local/mysql/lib -R/usr/local/mysql/lib \
-        -lmysqlclient -lz -lm'
+    "CCARGS=-DHAS_MYSQL -I/usr/local/mysql/include" \
+    "AUXLIBS_MYSQL=-L/usr/local/mysql/lib -R/usr/local/mysql/lib \
+        -lmysqlclient -lz -lm"
    diff --git a/postfix/proto/PGSQL_README.html b/postfix/proto/PGSQL_README.html index 61445ba4e..509b54e26 100644 --- a/postfix/proto/PGSQL_README.html +++ b/postfix/proto/PGSQL_README.html @@ -52,8 +52,8 @@ the location of the libpq library file. 

     % make tidy
 % make -f Makefile.init makefiles \
-        'CCARGS=-DHAS_PGSQL -I/usr/local/include/pgsql' \
-        'AUXLIBS_PGSQL=-L/usr/local/lib -lpq'
+        "CCARGS=-DHAS_PGSQL -I/usr/local/include/pgsql" \
+        "AUXLIBS_PGSQL=-L/usr/local/lib -lpq"
    diff --git a/postfix/proto/SASL_README.html b/postfix/proto/SASL_README.html index 0b33f3009..d405402d9 100644 --- a/postfix/proto/SASL_README.html +++ b/postfix/proto/SASL_README.html @@ -2044,8 +2044,8 @@ the Postfix top-level directory: 

     % make tidy # if you have left-over files from a previous build
-% make makefiles CCARGS='-DUSE_SASL_AUTH \
-    -DDEF_SERVER_SASL_TYPE=\"dovecot\"'
+% make makefiles CCARGS="-DUSE_SASL_AUTH \
+    -DDEF_SERVER_SASL_TYPE=\\\"dovecot\\\""
    @@ -2058,7 +2058,7 @@ the INSTALL document.

  • -

    The -DDEF_SERVER_SASL_TYPE=\"dovecot\" is not +

    The -DDEF_SERVER_SASL_TYPE=\\\"dovecot\\\" is not necessary; it just makes Postfix configuration a little more convenient because you don't have to specify the SASL plug-in type in the Postfix main.cf file (but this may cause surprises when you @@ -2077,10 +2077,10 @@ TLS_README for details. 

     % make tidy # if you have left-over files from a previous build
-% make makefiles CCARGS='-DUSE_SASL_AUTH \
-    -DDEF_SERVER_SASL_TYPE=\"dovecot\" \
-    ...CCARGS options for LDAP or TLS etc....' \
-   AUXLIBS='...AUXLIBS options for LDAP or TLS etc....'
+% make makefiles CCARGS="-DUSE_SASL_AUTH \
+    -DDEF_SERVER_SASL_TYPE=\\\"dovecot\\\" \
+    ...CCARGS options for LDAP or TLS etc...." \
+   AUXLIBS="...AUXLIBS options for LDAP or TLS etc...."
    diff --git a/postfix/proto/SQLITE_README.html b/postfix/proto/SQLITE_README.html index 598f80cf2..7c4e244c7 100644 --- a/postfix/proto/SQLITE_README.html +++ b/postfix/proto/SQLITE_README.html @@ -43,8 +43,8 @@ name of the standard POSIX thread library (pthread). For example: 
     make -f Makefile.init makefiles \
-     'CCARGS=-DHAS_SQLITE -I/usr/local/include' \
-     'AUXLIBS_SQLITE=-L/usr/local/lib -lsqlite3 -lpthread'
+     "CCARGS=-DHAS_SQLITE -I/usr/local/include" \
+     "AUXLIBS_SQLITE=-L/usr/local/lib -lsqlite3 -lpthread"
    diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto index be367b427..20a22cfaf 100644 --- a/postfix/proto/postconf.proto +++ b/postfix/proto/postconf.proto @@ -12198,17 +12198,11 @@ one "medium" or "high" grade cipher.

    The following cipher grades are supported:

    -
    export
    -
    Enable "EXPORT" grade or stronger OpenSSL ciphers. The -underlying cipherlist is specified via the tls_export_cipherlist -configuration parameter, which you are strongly encouraged not to -change. This choice is insecure and SHOULD NOT be used.
    - -
    low
    -
    Enable "LOW" grade or stronger OpenSSL ciphers. The underlying -cipherlist is specified via the tls_low_cipherlist configuration -parameter, which you are strongly encouraged not to change. This -choice is insecure and SHOULD NOT be used.
    +
    high
    +
    Enable only "HIGH" grade OpenSSL ciphers. The +underlying cipherlist is specified via the tls_high_cipherlist +configuration parameter, which you are strongly encouraged to +not change.
    medium
    Enable "MEDIUM" grade or stronger OpenSSL ciphers. These use 128-bit @@ -12217,12 +12211,6 @@ strength for mandatory TLS encryption. The underlying cipherlist is specified via the tls_medium_cipherlist configuration parameter, which you are strongly encouraged not to change.
    -
    high
    -
    Enable only "HIGH" grade OpenSSL ciphers. The -underlying cipherlist is specified via the tls_high_cipherlist -configuration parameter, which you are strongly encouraged to -not change.
    -
    null
    Enable only the "NULL" OpenSSL ciphers, these provide authentication without encryption. This setting is only appropriate in the rare @@ -12231,6 +12219,24 @@ enabled in TLS clients). The underlying cipherlist is specified via the tls_null_cipherlist configuration parameter, which you are strongly encouraged not to change.
    +
    low
    +
    Enable "LOW" grade or stronger OpenSSL ciphers. In Postfix +≥ 3.8 this cipher grade is always identical to "medium". Recent +versions of OpenSSL do not support any "LOW" grade ciphers. In +earlier Postfix releases the underlying cipherlist was specified +via the tls_low_cipherlist configuration parameter, which you are +strongly encouraged not to change. This obsolete cipher grade +SHOULD NOT be used.
    + +
    export
    +
    Enable "EXPORT" grade or stronger OpenSSL ciphers. In Postfix +≥ 3.8 this cipher grade is always identical to "medium". Recent +versions of OpenSSL do not support any "EXPORT" grade ciphers. In +earlier Postfix releases the underlying cipherlist was specified +via the tls_export_cipherlist configuration parameter, which you are +strongly encouraged not to change. This obsolete cipher grade +SHOULD NOT be used.
    +

    Cipher types listed in @@ -12304,24 +12310,6 @@ on a per-destination basis.

    The following cipher grades are supported:

    -
    export
    -
    Enable "EXPORT" grade or better OpenSSL ciphers. The underlying -cipherlist is specified via the tls_export_cipherlist configuration -parameter, which you are strongly encouraged not to change. This -choice is insecure and SHOULD NOT be used.
    - -
    low
    -
    Enable "LOW" grade or better OpenSSL ciphers. The underlying -cipherlist is specified via the tls_low_cipherlist configuration -parameter, which you are strongly encouraged not to change. This -choice is insecure and SHOULD NOT be used.
    - -
    medium
    -
    Enable "MEDIUM" grade or better OpenSSL ciphers. -The underlying cipherlist is specified via the tls_medium_cipherlist -configuration parameter, which you are strongly encouraged not to change. -
    -
    high
    Enable only "HIGH" grade OpenSSL ciphers. This setting may be appropriate when all mandatory TLS destinations (e.g. when all @@ -12330,6 +12318,12 @@ mail is routed to a suitably capable relayhost) support at least one tls_high_cipherlist configuration parameter, which you are strongly encouraged not to change.
    +
    medium
    +
    Enable "MEDIUM" grade or better OpenSSL ciphers. +The underlying cipherlist is specified via the tls_medium_cipherlist +configuration parameter, which you are strongly encouraged not to change. +
    +
    null
    Enable only the "NULL" OpenSSL ciphers, these provide authentication without encryption. This setting is only appropriate in the rare case @@ -12340,6 +12334,24 @@ underlying cipherlist is specified via the tls_null_cipherlist configuration parameter, which you are strongly encouraged not to change.
    +
    low
    +
    Enable "LOW" grade or stronger OpenSSL ciphers. In Postfix +≥ 3.8 this cipher grade is always identical to "medium". Recent +versions of OpenSSL do not support any "LOW" grade ciphers. In +earlier Postfix releases the underlying cipherlist was specified +via the tls_low_cipherlist configuration parameter, which you are +strongly encouraged not to change. This obsolete cipher grade +SHOULD NOT be used.
    + +
    export
    +
    Enable "EXPORT" grade or stronger OpenSSL ciphers. In Postfix +≥ 3.8 this cipher grade is always identical to "medium". Recent +versions of OpenSSL do not support any "EXPORT" grade ciphers. In +earlier Postfix releases the underlying cipherlist was specified +via the tls_export_cipherlist configuration parameter, which you are +strongly encouraged not to change. This obsolete cipher grade +SHOULD NOT be used.
    +

    The underlying cipherlists for grades other than "null" include @@ -12423,26 +12435,27 @@ to change this setting.

    %PARAM tls_low_cipherlist see "postconf -d" output -

    The OpenSSL cipherlist for "low" or higher grade ciphers. This defines -the meaning of the "low" setting in smtpd_tls_ciphers, -smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers, -lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. You are strongly -encouraged not to change this setting.

    +

    The OpenSSL cipherlist for "low" or higher grade ciphers. +Ignored as of Postfix 3.8. In earlier Postfix releases this +defined the meaning of the "low" setting in smtpd_tls_ciphers, +smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, +smtp_tls_mandatory_ciphers, lmtp_tls_ciphers, and +lmtp_tls_mandatory_ciphers. You are strongly encouraged not to +change this setting.

    -

    This feature is available in Postfix 2.3 and later.

    +

    This feature is available in Postfix 2.3 and later.

    %PARAM tls_export_cipherlist see "postconf -d" output -

    The OpenSSL cipherlist for "export" or higher grade ciphers. This -defines the meaning of the "export" setting in smtpd_tls_ciphers, -smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers, -lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. With Postfix -releases before the middle of 2015 this is the default cipherlist -for the opportunistic ("may") TLS client security level and also -the default cipherlist for the SMTP server. You are strongly -encouraged not to change this setting.

    +

    The OpenSSL cipherlist for "export" or higher grade ciphers. +Ignored as of Postfix 3.8. In earlier Postfix releases this +defined the meaning of the "export" setting in smtpd_tls_ciphers, +smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, +smtp_tls_mandatory_ciphers, lmtp_tls_ciphers, and +lmtp_tls_mandatory_ciphers. You are strongly encouraged not to +change this setting.

    -

    This feature is available in Postfix 2.3 and later.

    +

    This feature is available in Postfix 2.3 and later.

    %PARAM tls_null_cipherlist eNULL:!aNULL @@ -18575,7 +18588,7 @@ in environments where ports are dynamically assigned to servers. %PARAM ignore_srv_lookup_error no

    When SRV record lookup fails, fall back to MX or IP address -lookup as if SRV record lookup was not enabled. +lookup as if SRV record lookup was not enabled.

    This feature is available in Postfix 3.8 and later.

    diff --git a/postfix/proto/stop.double-cc b/postfix/proto/stop.double-cc index ceddb7f5c..333b55738 100644 --- a/postfix/proto/stop.double-cc +++ b/postfix/proto/stop.double-cc @@ -330,3 +330,4 @@ XXX XXX USE_FNV_32BIT USE_FNV_32BIT void void cleanup_milter_receive state count struct DICT open const char int int dict_xx_open + Available in in Postfix version 2 3 3 7 diff --git a/postfix/proto/stop.double-history b/postfix/proto/stop.double-history index 425aa26bf..018d3af39 100644 --- a/postfix/proto/stop.double-history +++ b/postfix/proto/stop.double-history @@ -24,3 +24,9 @@ smtp smtp_connect c smtp smtp h smtp smtp_params c arguments Files src dns dns h src dns dns_rr_eq_sa c only a subset of all arguments Files src dns dns h + global mail_params h smtp smtp c smtpd smtpd c tls tls_misc c + global mail_params h smtp smtp c smtpd smtpd c tls tls_misc c + tls tls_proxy_client_scan c tls tls_proxy h tlsproxy tlsproxy c + smtp smtp c smtpd smtpd c tls tls_misc c + smtp smtp c smtpd smtpd c tls tls_misc c +proto proto SASL_README html proto SQLITE_README html diff --git a/postfix/proto/stop.spell-history b/postfix/proto/stop.spell-history index 46e64559b..83139f491 100644 --- a/postfix/proto/stop.spell-history +++ b/postfix/proto/stop.spell-history @@ -44,3 +44,4 @@ NOPORT NOPREF NOWEIGHT modernisms +Bordo diff --git a/postfix/src/global/mail_params.h b/postfix/src/global/mail_params.h index b364850c5..ad227e240 100644 --- a/postfix/src/global/mail_params.h +++ b/postfix/src/global/mail_params.h @@ -3322,24 +3322,32 @@ extern bool var_smtp_cname_overr; /* * TLS cipherlists */ + /* Deprecated and unused cipher, key exchange and public key algorithms */ +#define TLS_EXCL_CIPHS ":!SEED:!IDEA:!3DES:!RC2:!RC4:!RC5" +#define TLS_EXCL_KEXCH ":!kDH:!kECDH" +#define TLS_EXCL_PKEYS ":!aDSS" +#define TLS_EXCL_DGSTS ":!MD5" +#define TLS_EXCL TLS_EXCL_CIPHS TLS_EXCL_REST +#define TLS_EXCL_REST TLS_EXCL_KEXCH TLS_EXCL_PKEYS TLS_EXCL_DGSTS + #define VAR_TLS_HIGH_CLIST "tls_high_cipherlist" -#define DEF_TLS_HIGH_CLIST "aNULL:-aNULL:HIGH:@STRENGTH" +#define DEF_TLS_HIGH_CLIST "aNULL:-aNULL:HIGH" TLS_EXCL ":@STRENGTH" extern char *var_tls_high_clist; #define VAR_TLS_MEDIUM_CLIST "tls_medium_cipherlist" -#define DEF_TLS_MEDIUM_CLIST "aNULL:-aNULL:HIGH:MEDIUM:+RC4:@STRENGTH" +#define DEF_TLS_MEDIUM_CLIST "aNULL:-aNULL:HIGH:MEDIUM" TLS_EXCL ":+RC4:@STRENGTH" extern char *var_tls_medium_clist; #define VAR_TLS_LOW_CLIST "tls_low_cipherlist" -#define DEF_TLS_LOW_CLIST "aNULL:-aNULL:HIGH:MEDIUM:LOW:+RC4:@STRENGTH" -extern char *var_tls_low_clist; +#define DEF_TLS_LOW_CLIST "" +extern char *var_tls_low_ignored; #define VAR_TLS_EXPORT_CLIST "tls_export_cipherlist" -#define DEF_TLS_EXPORT_CLIST "aNULL:-aNULL:HIGH:MEDIUM:LOW:EXPORT:+RC4:@STRENGTH" -extern char *var_tls_export_clist; +#define DEF_TLS_EXPORT_CLIST "" +extern char *var_tls_export_ignored; #define VAR_TLS_NULL_CLIST "tls_null_cipherlist" -#define DEF_TLS_NULL_CLIST "eNULL:!aNULL" +#define DEF_TLS_NULL_CLIST "eNULL" TLS_EXCL_REST ":!aNULL" extern char *var_tls_null_clist; #if defined(SN_X25519) && defined(NID_X25519) diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h index d67ef3aac..218ace73a 100644 --- a/postfix/src/global/mail_version.h +++ b/postfix/src/global/mail_version.h @@ -20,7 +20,7 @@ * Patches change both the patchlevel and the release date. Snapshots have no * patchlevel; they change the release date only. */ -#define MAIL_RELEASE_DATE "20230219" +#define MAIL_RELEASE_DATE "20230304" #define MAIL_VERSION_NUMBER "3.8" #ifdef SNAPSHOT diff --git a/postfix/src/smtp/smtp.c b/postfix/src/smtp/smtp.c index e865197ab..8f1413d93 100644 --- a/postfix/src/smtp/smtp.c +++ b/postfix/src/smtp/smtp.c @@ -360,10 +360,10 @@ /* records. /* .IP "\fBignore_srv_lookup_error (no)\fR" /* When SRV record lookup fails, fall back to MX or IP address -/* lookup as if SRV record lookups were not enabled. +/* lookup as if SRV record lookup was not enabled. /* .IP "\fBallow_srv_lookup_fallback (no)\fR" /* When SRV record lookup fails or no SRV record exists, fall back -/* to MX or IP address lookup as if SRV record lookups were not enabled. +/* to MX or IP address lookup as if SRV record lookup was not enabled. /* MIME PROCESSING CONTROLS /* .ad /* .fi @@ -506,13 +506,15 @@ /* The OpenSSL cipherlist for "high" grade ciphers. /* .IP "\fBtls_medium_cipherlist (see 'postconf -d' output)\fR" /* The OpenSSL cipherlist for "medium" or higher grade ciphers. +/* .IP "\fBtls_null_cipherlist (eNULL:!aNULL)\fR" +/* The OpenSSL cipherlist for "NULL" grade ciphers that provide +/* authentication without encryption. +/* .PP +/* Available in in Postfix version 2.3..3.7: /* .IP "\fBtls_low_cipherlist (see 'postconf -d' output)\fR" /* The OpenSSL cipherlist for "low" or higher grade ciphers. /* .IP "\fBtls_export_cipherlist (see 'postconf -d' output)\fR" /* The OpenSSL cipherlist for "export" or higher grade ciphers. -/* .IP "\fBtls_null_cipherlist (eNULL:!aNULL)\fR" -/* The OpenSSL cipherlist for "NULL" grade ciphers that provide -/* authentication without encryption. /* .PP /* Available in Postfix version 2.4 and later: /* .IP "\fBsmtp_sasl_tls_verified_security_options ($smtp_sasl_tls_security_options)\fR" diff --git a/postfix/src/smtpd/smtpd.c b/postfix/src/smtpd/smtpd.c index 143d44171..0807387ff 100644 --- a/postfix/src/smtpd/smtpd.c +++ b/postfix/src/smtpd/smtpd.c @@ -451,13 +451,15 @@ /* The OpenSSL cipherlist for "high" grade ciphers. /* .IP "\fBtls_medium_cipherlist (see 'postconf -d' output)\fR" /* The OpenSSL cipherlist for "medium" or higher grade ciphers. +/* .IP "\fBtls_null_cipherlist (eNULL:!aNULL)\fR" +/* The OpenSSL cipherlist for "NULL" grade ciphers that provide +/* authentication without encryption. +/* .PP +/* Available in Postfix version 2.3..3.7: /* .IP "\fBtls_low_cipherlist (see 'postconf -d' output)\fR" /* The OpenSSL cipherlist for "low" or higher grade ciphers. /* .IP "\fBtls_export_cipherlist (see 'postconf -d' output)\fR" /* The OpenSSL cipherlist for "export" or higher grade ciphers. -/* .IP "\fBtls_null_cipherlist (eNULL:!aNULL)\fR" -/* The OpenSSL cipherlist for "NULL" grade ciphers that provide -/* authentication without encryption. /* .PP /* Available in Postfix version 2.5 and later: /* .IP "\fBsmtpd_tls_fingerprint_digest (see 'postconf -d' output)\fR" diff --git a/postfix/src/tls/tls_misc.c b/postfix/src/tls/tls_misc.c index 7c3aaf486..b7000cbab 100644 --- a/postfix/src/tls/tls_misc.c +++ b/postfix/src/tls/tls_misc.c @@ -31,8 +31,6 @@ /* /* char *var_tls_high_clist; /* char *var_tls_medium_clist; -/* char *var_tls_low_clist; -/* char *var_tls_export_clist; /* char *var_tls_null_clist; /* char *var_tls_eecdh_auto; /* char *var_tls_eecdh_strong; @@ -169,11 +167,10 @@ /* contains invalid protocol names, TLS_PROTOCOL_INVALID is returned and /* no warning is logged. /* -/* tls_cipher_grade() converts a case-insensitive cipher grade -/* name (high, medium, low, export, null) to the corresponding -/* TLS_CIPHER_ constant. When the input specifies an unrecognized -/* grade, tls_cipher_grade() logs no warning, and returns -/* TLS_CIPHER_NONE. +/* tls_cipher_grade() converts a case-insensitive cipher grade name (high, +/* medium, null) to the corresponding TLS_CIPHER_ constant. When the +/* input specifies an unrecognized grade, tls_cipher_grade() logs no +/* warning, and returns TLS_CIPHER_NONE. /* /* str_tls_cipher_grade() converts a cipher grade to a name. /* When the input specifies an undefined grade, str_tls_cipher_grade() @@ -279,8 +276,8 @@ */ char *var_tls_high_clist; char *var_tls_medium_clist; -char *var_tls_low_clist; -char *var_tls_export_clist; +char *var_tls_low_ignored; +char *var_tls_export_ignored; char *var_tls_null_clist; int var_tls_daemon_rand_bytes; char *var_tls_eecdh_auto; @@ -498,8 +495,8 @@ static const LONG_NAME_MASK ssl_op_tweaks[] = { const NAME_CODE tls_cipher_grade_table[] = { "high", TLS_CIPHER_HIGH, "medium", TLS_CIPHER_MEDIUM, - "low", TLS_CIPHER_LOW, - "export", TLS_CIPHER_EXPORT, + "low", TLS_CIPHER_MEDIUM, + "export", TLS_CIPHER_MEDIUM, "null", TLS_CIPHER_NULL, "invalid", TLS_CIPHER_NONE, 0, TLS_CIPHER_NONE, @@ -648,8 +645,8 @@ void tls_param_init(void) static const CONFIG_STR_TABLE str_table[] = { VAR_TLS_HIGH_CLIST, DEF_TLS_HIGH_CLIST, &var_tls_high_clist, 1, 0, VAR_TLS_MEDIUM_CLIST, DEF_TLS_MEDIUM_CLIST, &var_tls_medium_clist, 1, 0, - VAR_TLS_LOW_CLIST, DEF_TLS_LOW_CLIST, &var_tls_low_clist, 1, 0, - VAR_TLS_EXPORT_CLIST, DEF_TLS_EXPORT_CLIST, &var_tls_export_clist, 1, 0, + VAR_TLS_LOW_CLIST, DEF_TLS_LOW_CLIST, &var_tls_low_ignored, 0, 0, + VAR_TLS_EXPORT_CLIST, DEF_TLS_EXPORT_CLIST, &var_tls_export_ignored, 0, 0, VAR_TLS_NULL_CLIST, DEF_TLS_NULL_CLIST, &var_tls_null_clist, 1, 0, VAR_TLS_EECDH_AUTO, DEF_TLS_EECDH_AUTO, &var_tls_eecdh_auto, 0, 0, VAR_TLS_EECDH_STRONG, DEF_TLS_EECDH_STRONG, &var_tls_eecdh_strong, 1, 0, @@ -816,12 +813,6 @@ const char *tls_set_ciphers(TLS_SESS_STATE *TLScontext, const char *grade, case TLS_CIPHER_MEDIUM: vstring_strcpy(buf, var_tls_medium_clist); break; - case TLS_CIPHER_LOW: - vstring_strcpy(buf, var_tls_low_clist); - break; - case TLS_CIPHER_EXPORT: - vstring_strcpy(buf, var_tls_export_clist); - break; case TLS_CIPHER_NULL: vstring_strcpy(buf, var_tls_null_clist); break; diff --git a/postfix/src/tls/tls_proxy.h b/postfix/src/tls/tls_proxy.h index 0a4f7e2e3..f3eb0f611 100644 --- a/postfix/src/tls/tls_proxy.h +++ b/postfix/src/tls/tls_proxy.h @@ -46,8 +46,6 @@ typedef struct TLS_CLIENT_PARAMS { char *tls_high_clist; char *tls_medium_clist; - char *tls_low_clist; - char *tls_export_clist; char *tls_null_clist; char *tls_eecdh_auto; char *tls_eecdh_strong; @@ -66,12 +64,12 @@ typedef struct TLS_CLIENT_PARAMS { } TLS_CLIENT_PARAMS; #define TLS_PROXY_PARAMS(params, a1, a2, a3, a4, a5, a6, a7, a8, \ - a9, a10, a11, a12, a13, a14, a15, a16, a17, a18, a19) \ + a9, a10, a11, a12, a13, a14, a15, a16, a17) \ (((params)->a1), ((params)->a2), ((params)->a3), \ ((params)->a4), ((params)->a5), ((params)->a6), ((params)->a7), \ ((params)->a8), ((params)->a9), ((params)->a10), ((params)->a11), \ ((params)->a12), ((params)->a13), ((params)->a14), ((params)->a15), \ - ((params)->a16), ((params)->a17), ((params)->a18), ((params)->a19)) + ((params)->a16), ((params)->a17)) /* * tls_proxy_client_param_misc.c, tls_proxy_client_param_print.c, and diff --git a/postfix/src/tls/tls_proxy_client_misc.c b/postfix/src/tls/tls_proxy_client_misc.c index d9f7774ec..e9a24ea79 100644 --- a/postfix/src/tls/tls_proxy_client_misc.c +++ b/postfix/src/tls/tls_proxy_client_misc.c @@ -68,8 +68,6 @@ TLS_CLIENT_PARAMS *tls_proxy_client_param_from_config(TLS_CLIENT_PARAMS *params) TLS_PROXY_PARAMS(params, tls_high_clist = var_tls_high_clist, tls_medium_clist = var_tls_medium_clist, - tls_low_clist = var_tls_low_clist, - tls_export_clist = var_tls_export_clist, tls_null_clist = var_tls_null_clist, tls_eecdh_auto = var_tls_eecdh_auto, tls_eecdh_strong = var_tls_eecdh_strong, diff --git a/postfix/src/tls/tls_proxy_client_print.c b/postfix/src/tls/tls_proxy_client_print.c index 9d22cc3e1..616eb45d5 100644 --- a/postfix/src/tls/tls_proxy_client_print.c +++ b/postfix/src/tls/tls_proxy_client_print.c @@ -98,9 +98,6 @@ int tls_proxy_client_param_print(ATTR_PRINT_COMMON_FN print_fn, VSTREAM *fp, SEND_ATTR_STR(VAR_TLS_HIGH_CLIST, params->tls_high_clist), SEND_ATTR_STR(VAR_TLS_MEDIUM_CLIST, params->tls_medium_clist), - SEND_ATTR_STR(VAR_TLS_LOW_CLIST, params->tls_low_clist), - SEND_ATTR_STR(VAR_TLS_EXPORT_CLIST, - params->tls_export_clist), SEND_ATTR_STR(VAR_TLS_NULL_CLIST, params->tls_null_clist), SEND_ATTR_STR(VAR_TLS_EECDH_AUTO, params->tls_eecdh_auto), SEND_ATTR_STR(VAR_TLS_EECDH_STRONG, diff --git a/postfix/src/tls/tls_proxy_client_scan.c b/postfix/src/tls/tls_proxy_client_scan.c index 826ef2fc8..a4767b792 100644 --- a/postfix/src/tls/tls_proxy_client_scan.c +++ b/postfix/src/tls/tls_proxy_client_scan.c @@ -123,8 +123,6 @@ void tls_proxy_client_param_free(TLS_CLIENT_PARAMS *params) { myfree(params->tls_high_clist); myfree(params->tls_medium_clist); - myfree(params->tls_low_clist); - myfree(params->tls_export_clist); myfree(params->tls_null_clist); myfree(params->tls_eecdh_auto); myfree(params->tls_eecdh_strong); @@ -148,8 +146,6 @@ int tls_proxy_client_param_scan(ATTR_SCAN_COMMON_FN scan_fn, VSTREAM *fp, int ret; VSTRING *tls_high_clist = vstring_alloc(25); VSTRING *tls_medium_clist = vstring_alloc(25); - VSTRING *tls_low_clist = vstring_alloc(25); - VSTRING *tls_export_clist = vstring_alloc(25); VSTRING *tls_null_clist = vstring_alloc(25); VSTRING *tls_eecdh_auto = vstring_alloc(25); VSTRING *tls_eecdh_strong = vstring_alloc(25); @@ -171,8 +167,6 @@ int tls_proxy_client_param_scan(ATTR_SCAN_COMMON_FN scan_fn, VSTREAM *fp, ret = scan_fn(fp, flags | ATTR_FLAG_MORE, RECV_ATTR_STR(VAR_TLS_HIGH_CLIST, tls_high_clist), RECV_ATTR_STR(VAR_TLS_MEDIUM_CLIST, tls_medium_clist), - RECV_ATTR_STR(VAR_TLS_LOW_CLIST, tls_low_clist), - RECV_ATTR_STR(VAR_TLS_EXPORT_CLIST, tls_export_clist), RECV_ATTR_STR(VAR_TLS_NULL_CLIST, tls_null_clist), RECV_ATTR_STR(VAR_TLS_EECDH_AUTO, tls_eecdh_auto), RECV_ATTR_STR(VAR_TLS_EECDH_STRONG, tls_eecdh_strong), @@ -197,8 +191,6 @@ int tls_proxy_client_param_scan(ATTR_SCAN_COMMON_FN scan_fn, VSTREAM *fp, /* Always construct a well-formed structure. */ params->tls_high_clist = vstring_export(tls_high_clist); params->tls_medium_clist = vstring_export(tls_medium_clist); - params->tls_low_clist = vstring_export(tls_low_clist); - params->tls_export_clist = vstring_export(tls_export_clist); params->tls_null_clist = vstring_export(tls_null_clist); params->tls_eecdh_auto = vstring_export(tls_eecdh_auto); params->tls_eecdh_strong = vstring_export(tls_eecdh_strong); @@ -210,7 +202,7 @@ int tls_proxy_client_param_scan(ATTR_SCAN_COMMON_FN scan_fn, VSTREAM *fp, params->tls_mgr_service = vstring_export(tls_mgr_service); params->tls_tkt_cipher = vstring_export(tls_tkt_cipher); - ret = (ret == 19 ? 1 : -1); + ret = (ret == 17 ? 1 : -1); if (ret != 1) { tls_proxy_client_param_free(params); params = 0; diff --git a/postfix/src/tlsproxy/tlsproxy.c b/postfix/src/tlsproxy/tlsproxy.c index 20b50edae..18203f787 100644 --- a/postfix/src/tlsproxy/tlsproxy.c +++ b/postfix/src/tlsproxy/tlsproxy.c @@ -74,10 +74,6 @@ /* The OpenSSL cipherlist for "high" grade ciphers. /* .IP "\fBtls_medium_cipherlist (see 'postconf -d' output)\fR" /* The OpenSSL cipherlist for "medium" or higher grade ciphers. -/* .IP "\fBtls_low_cipherlist (see 'postconf -d' output)\fR" -/* The OpenSSL cipherlist for "low" or higher grade ciphers. -/* .IP "\fBtls_export_cipherlist (see 'postconf -d' output)\fR" -/* The OpenSSL cipherlist for "export" or higher grade ciphers. /* .IP "\fBtls_null_cipherlist (eNULL:!aNULL)\fR" /* The OpenSSL cipherlist for "NULL" grade ciphers that provide /* authentication without encryption. @@ -96,6 +92,12 @@ /* preference order instead of the remote client's cipher preference /* order. /* .PP +/* Available in Postfix version 2.8..3.7: +/* .IP "\fBtls_low_cipherlist (see 'postconf -d' output)\fR" +/* The OpenSSL cipherlist for "low" or higher grade ciphers. +/* .IP "\fBtls_export_cipherlist (see 'postconf -d' output)\fR" +/* The OpenSSL cipherlist for "export" or higher grade ciphers. +/* .PP /* Available in Postfix version 2.9 and later: /* .IP "\fBtls_legacy_public_key_fingerprints (no)\fR" /* A temporary migration aid for sites that use certificate