-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Tue, 01 Oct 2019 19:28:19 -0400
Source: postfix
Architecture: source
Version: 3.1.14-0+deb9u1
Distribution: stretch
Urgency: medium
Maintainer: LaMont Jones <lamont@debian.org>
Changed-By: Scott Kitterman <scott@kitterman.com>
Changes:
postfix (3.1.14-0+deb9u1) stretch; urgency=medium
.
[Wietse Venema]
.
* 3.1.13
- Bugfix (introduced: Postfix 2.3): a censoring filter broke
multiline Milter responses for header/body events. Problem
report by Andreas Thienemann. Files: util/printable.c,
util/stringops.h, smtpd/smtpd.c
- Workaround for implementations that hang Postfix while
shutting down a TLS session, until Postfix times out. With
"tls_fast_shutdown_enable = yes" (the default), Postfix no
longer waits for the TLS peer to respond to a TLS 'close'
request. This is recommended with TLSv1.0 and later. Files:
global/mail_params.h, tls/tls_session.c, and documentation.
- Bugfix (introduced: Postfix 3.0): the code to reset Postfix
SMTP server command counts was not called after a HaProxy
handshake failure, causing stale numbers to be reported.
The command counts are now reset in the function that reports
the counts. File: smtpd/smtpd.c
* 3.1.14
- Bugfix: the documentation said tls_fast_shutdown_enable,
but the code said tls_fast_shutdown. Viktor Dukhovni. Changed
the code because no-one is expected to override the default.
File: global/mail_params.h.
- Workaround for poor TCP loopback performance on LINUX, where
getsockopt(..., TCP_MAXSEG, ..) reports a TCP maximal segment
size that is 1/2 to 1/3 of the MTU. For example, with kernel
5.1.16-300.fc30.x86_64 the TCP client and server announce
an mss of 65495 in the TCP handshake, but getsockopt()
returns 32741 (less than half). As a matter of principle,
Postfix won't turn on client-side TCP_NODELAY because that
hides application performance bugs, and because that still
suffers from server-side delayed ACKs. Instead, Postfix
avoids sending "small" writes back-to-back, by choosing a
VSTREAM buffer size that is a multiple of the reported MSS.
This workaround bumps the multiplier from 2x to 4x. File:
util/vstream_tweak.c.
- Bugfix (introduced: 20051222): the Dovecot client could
segfault (null pointer read) or cause an SMTP server assertion
to fail when talking to a fake Dovecot server. The client
now logs a proper error instead. Problem reported by Tim
Düsterhus. File: xsasl/xsasl_dovecot_server.c.
- Bitrot: don't invoke SSL_shutdown() when the SSL engine
thinks it is processing a TLS handshake. The commit at
https://github.com/openssl/openssl/commit/64193c8218540499984cd63cda41f3cd491f3f59
changed the error status, incompatibly, from SSL_ERROR_NONE
into SSL_ERROR_SSL. File: tlsproxy/tlsproxxy.c.
- Bugfix (introduced: Postfix-2.9.0): null pointer read, while
logging a warning after a postscreen_command_filter read
error. File: postscreen/postscreen_smtpd.c.
Checksums-Sha1:
ed4dadd74303c4a148e507bcf44e177cfe2bf131 2699 postfix_3.1.14-0+deb9u1.dsc
08a53f872aa0e24c145bebab9c956c3b7fc99f5d 4334198 postfix_3.1.14.orig.tar.gz
4ad628161ca9af34b45679ab2ca5425564e33884 196336 postfix_3.1.14-0+deb9u1.debian.tar.xz
56bd08e8a4a63ba1300795b99531e42a0c059e7e 7659 postfix_3.1.14-0+deb9u1_source.buildinfo
Checksums-Sha256:
efcfc79fd9cabceeac019c1a2e9f5c4e89333c48bdc0d1fb35dba7ee3c7dfd32 2699 postfix_3.1.14-0+deb9u1.dsc
0cd07f1cedc9481424c3d32a6fa674195afa57aa6bd41a1efaee31efcde1b482 4334198 postfix_3.1.14.orig.tar.gz
4bac523852dd9e66217c472e183a61c3ad48d8e64407e1a81003172816619b7f 196336 postfix_3.1.14-0+deb9u1.debian.tar.xz
bf0106b3eed9cf2ac1923ee76635fcb7c661f026fd9b9cfe828af9dc4e874429 7659 postfix_3.1.14-0+deb9u1_source.buildinfo
Files:
f9d684233eba886ab5e13c38c1363017 2699 mail extra postfix_3.1.14-0+deb9u1.dsc
afaba74224c21176ba87317ec4d21aa7 4334198 mail extra postfix_3.1.14.orig.tar.gz
51db7a66ab788f65f6be765746757716 196336 mail extra postfix_3.1.14-0+deb9u1.debian.tar.xz
32717701929398406c8cf8ee77abdd5e 7659 mail extra postfix_3.1.14-0+deb9u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEE53Kb/76FQA/u7iOxeNfe+5rVmvEFAl2T4W8ACgkQeNfe+5rV
mvHaRRAA1n0tT1uTrHLk/oHj7ZSghCtk1gbxjIMhldo0wp6Am8Ta4Xk6pKlO+WlK
Xcta+f9AvauYEjghAAINNueH/wiDEojNvdh27WYWvOzLDS4/U7ZZKE0/vf+A5fq+
UerpLJMZmxa+05t7ajWBssq/lNdDLWLdhKa1x59+Fzod2Toxqh9NUYBIhxIA24cA
Alw6HD+TNU6lTGSa1vNNMu6PcdhsMzA2EXJc+F/5DaLkBsDryPdTBJNidU+4rfs3
FmQGYUMkKbch1xOBbdAyhpO77PwM3bck24MylhQyUdL5dHaRH7GQbtv9t+RnlcqN
L/UK/o6l8KMVOAdLkSlF8+GmhGEQ+NfibXPHDUZXnbrci3rZX/SAZgSdRIIWceiJ
iHKgYhaw5IUpUm1xFCAWVZboqGJhQe5eFAK+KvXkwXUdmF5NsWrGZlYN7j07xsxA
Kv93dHAKv+T1BEH0POB+GxVqfkbffuo8ofMOgS/bmsL7Y4vKnVS8cIoIJCQt7Mg/
G3rOfIWJtVe19SGc8CJXxDa8tvzpxR9YJlQeGSkwadTBCQS4Jzdd9BH9iEffmbxe
ns1AJCZGURNv/JehZ+QwwntBw1eno1iIQweRItRTTqdQwMt08fLVXd8XKe8dARXE
cXPXYJ57mSH1CmZi8lV5I/pDg6UtdoFLQx/+xJ8bJAmKWVO0SK8=
=PSPq
-----END PGP SIGNATURE-----
