June 2016 - openSUSE Commits - openSUSE Mailing Lists

commit firewalld for openSUSE:Factory
by root＠hilbert.suse.de 02 Jun '16

02 Jun '16

Hello community, here is the log from the commit of package firewalld for openSUSE:Factory checked in at 2016-06-02 12:39:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/firewalld (Old) and /work/SRC/openSUSE:Factory/.firewalld.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "firewalld" Changes: -------- --- /work/SRC/openSUSE:Factory/firewalld/firewalld.changes 2016-05-30 09:55:53.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.firewalld.new/firewalld.changes 2016-06-02 12:39:19.000000000 +0200 @@ -1,0 +2,55 @@ +Tue May 31 08:30:44 UTC 2016 - mchandras(a)suse.de + +- Update to version 0.4.2 + * New module to search for and change ifcfg files for interfaces + not under control of NM + * firewall_config: Enhanced messages in status bar + * firewall-config: New message window as overlay if not connected + * firewall-config: Fix sentivity of option, view menus and main + paned if not connected + * firewall-applet: Quit on SIGINT (Ctrl-C), reduced D-Bus calls, + some cleanup + * firewall-[offline]cmd: Show target in zone information + * D-Bus: Completed masquerade methods in FirewallClientZoneSettings + * Fixed log-denied rules for icmp-blocks + * Keep sorting of interfaces, services, icmp-blocks and other + settings in zones + * Fixed runtime-to-permanent not to save interfaces under control + of NM + * New icmp-block-inversion flag in the zones + * ICMP type filtering in the zones + * New services: sip, sips, managesieve + * rich rules: Allow destination action (RHBZ#1163428) + * firewall-offline-cmd: New option -q/--quiet + * firewall-[offline-]cmd: New --add-[zone,service,ipset,icmptype]-from-file + * firewall-[offline-]cmd: Fix option for setting the destination + address + * firewall-config: Fixed resizing behaviour + * New transaction model for speed ups in start, restart, stop and + other actions + * firewall-cmd: New options --load{zone,service,ipset,icmptype}-defaults + * Fixed memory leak in dbus_introspection_add_properties + * Landscape.io fixes, pylint calm downs + * New D-Bus getXnames methods to speed up firewall-config and firewall-cmd + * ebtables-restore: No support for COMMIT command + * Source port support in services, zones and rich rules + * firewall-offline-cmd: Added --{add,remove}-entries-from-file for ipsets + * firewall-config: New active bindings side bar for simple binding changes + * Reworked NetworkManager module + * Proper default zone handling for NM connections + * Try to set zone binding with NM if interface is under control of NM + * Code cleanup and bug fixes + * Include test suite in the release and install in /usr/share/firewalld/tests + * New Travis-CI configuration file + * Fixed more broken frensh translations + * Translation updates +- Add upstream patches + * 0001-src-firewall-core-Drop-unneeded-python-shebangs.patch: Removes + unneeded python shebangs + * 0002-firewall-core-fw_ifcfg-Quickly-return-if-ifcfg-direc.patch: Do + not try to access the network-scripts ifcfg directory. +- Drop rejected patch + * drop-standard-output-error-systemd.patch +- Minor spec file clean-up + +------------------------------------------------------------------- Old: ---- drop-standard-output-error-systemd.patch firewalld-0.4.1.2.tar.bz2 New: ---- 0001-src-firewall-core-Drop-unneeded-python-shebangs.patch 0002-firewall-core-fw_ifcfg-Quickly-return-if-ifcfg-direc.patch firewalld-0.4.2.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ firewalld.spec ++++++ --- /var/tmp/diff_new_pack.xHGcKJ/_old 2016-06-02 12:39:20.000000000 +0200 +++ /var/tmp/diff_new_pack.xHGcKJ/_new 2016-06-02 12:39:20.000000000 +0200 @@ -17,17 +17,19 @@ Name: firewalld -Version: 0.4.1.2 +Version: 0.4.2 Release: 0 Summary: A firewall daemon with D-Bus interface providing a dynamic firewall License: GPL-2.0+ Group: Productivity/Networking/Security Url: http://www.firewalld.org Source: https://fedorahosted.org/released/%{name}/%{name}-%{version}.tar.bz2 -# PATCH-FIX-OPENSUSE: drop-standard-output-error-systemd.patch, -# https://github.com/t-woerner/firewalld/pull/67(pending) -- Do not supress -# stdout/stderr for firewalld -Patch0: drop-standard-output-error-systemd.patch +# PATCH-FIX-UPSTREAM: 0001-src-firewall-core-Drop-unneeded-python-shebangs.patch +# Drop python shebangs +Patch0: 0001-src-firewall-core-Drop-unneeded-python-shebangs.patch +# PATCH-FIX-UPSTREAM: 0002-firewall-core-fw_ifcfg-Quickly-return-if-ifcfg-direc.patch +# Do not access the ifcfg directory if it does not exist +Patch1: 0002-firewall-core-fw_ifcfg-Quickly-return-if-ifcfg-direc.patch BuildRequires: desktop-file-utils BuildRequires: docbook-xsl-stylesheets BuildRequires: gettext @@ -54,9 +56,7 @@ Recommends: %{name}-lang Suggests: susefirewall2-to-firewalld BuildArch: noarch -%if 0%{?suse_version} >= 1210 BuildRequires: systemd-rpm-macros -%endif %description firewalld is a firewall service daemon that provides a dynamic customizable @@ -91,6 +91,7 @@ %prep %setup -q %patch0 -p1 +%patch1 -p1 %build %configure --enable-sysconfig --enable-rpmmacros @@ -182,7 +183,7 @@ %{_libexecdir}/firewalld/services/*.xml %{_libexecdir}/firewalld/zones/*.xml %{_datadir}/polkit-1 -%{_sysconfdir}/rpm/macros.firewalld +%config %{_sysconfdir}/rpm/macros.firewalld %dir %{_sysconfdir}/dbus-1 %dir %{_sysconfdir}/dbus-1/system.d %attr(0750,root,root) %dir %{_libexecdir}/firewalld @@ -192,6 +193,7 @@ %attr(0750,root,root) %dir %{_libexecdir}/firewalld/services %attr(0750,root,root) %dir %{_libexecdir}/firewalld/zones %attr(0750,root,root) %dir %{_sysconfdir}/firewalld +%attr(0750,root,root) %{_datadir}/firewalld/tests %config(noreplace) %{_sysconfdir}/firewalld/firewalld.conf %config(noreplace) %{_sysconfdir}/firewalld/lockdown-whitelist.xml %attr(0750,root,root) %dir %{_sysconfdir}/firewalld/icmptypes @@ -230,6 +232,7 @@ %attr(0755,root,root) %{_bindir}/firewall-config %{_datadir}/firewalld/firewall-config.glade %attr(0755,root,root) %{_datadir}/firewalld/gtk3_chooserbutton.py* +%attr(0755,root,root) %{_datadir}/firewalld/gtk3_niceexpander.py* %{_datadir}/applications/firewall-config.desktop %dir %{_datadir}/appdata %{_datadir}/appdata/firewall-config.appdata.xml ++++++ 0001-src-firewall-core-Drop-unneeded-python-shebangs.patch ++++++ >From 705742816112dffefd3233f2c8dda7c845c6e8b3 Mon Sep 17 00:00:00 2001 From: Markos Chandras <mchandras(a)suse.de> Date: Tue, 31 May 2016 10:08:28 +0100 Subject: [PATCH] src: firewall: core: Drop unneeded python shebangs The fw_ifcfg and fw_nm files are not supposed to be executed as standalone files but rather imported by the main firewalld code so drop the python shebangs. This also fixes a warning when building firewalld in openSUSE OBS: firewalld.noarch: W: non-executable-script /usr/lib/python2.7/site-packages/firewall/core/fw_nm.py 644 /usr/bin/python firewalld.noarch: W: non-executable-script /usr/lib/python2.7/site-packages/firewall/core/fw_ifcfg.py 644 /usr/bin/python --- src/firewall/core/fw_ifcfg.py | 1 - src/firewall/core/fw_nm.py | 1 - 2 files changed, 2 deletions(-) diff --git a/src/firewall/core/fw_ifcfg.py b/src/firewall/core/fw_ifcfg.py index 442a6cc..33794a7 100644 --- a/src/firewall/core/fw_ifcfg.py +++ b/src/firewall/core/fw_ifcfg.py @@ -1,4 +1,3 @@ -#!/usr/bin/python # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. diff --git a/src/firewall/core/fw_nm.py b/src/firewall/core/fw_nm.py index 38ef8fd..3df94c4 100644 --- a/src/firewall/core/fw_nm.py +++ b/src/firewall/core/fw_nm.py @@ -1,4 +1,3 @@ -#!/usr/bin/python # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. -- 2.8.3 ++++++ 0002-firewall-core-fw_ifcfg-Quickly-return-if-ifcfg-direc.patch ++++++ >From 9ed2c18357d45f8ec1f11723a1d98377387c1039 Mon Sep 17 00:00:00 2001 From: Markos Chandras <mchandras(a)suse.de> Date: Tue, 31 May 2016 11:14:06 +0100 Subject: [PATCH] firewall: core: fw_ifcfg: Quickly return if ifcfg directory does not exist It's possible for the ifcfg directory to be missing or named differently so do not try to access it if it does not exist. This avoid warnings during firewalld start up like the following one: ERROR: Calling post func <function ifcfg_set_zone_of_interface at 0x7fb2f0d4fc80> (('', 'enp3s0')) failed: [Errno 2] No such file or directory: '/etc/sysconfig/network-scripts' --- src/firewall/core/fw_ifcfg.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/firewall/core/fw_ifcfg.py b/src/firewall/core/fw_ifcfg.py index 33794a7..0b049a6 100644 --- a/src/firewall/core/fw_ifcfg.py +++ b/src/firewall/core/fw_ifcfg.py @@ -32,6 +32,10 @@ from firewall.core.io.ifcfg import ifcfg def search_ifcfg_of_interface(interface): """search ifcfg file for the interface in config.IFCFGDIR""" + # Return quickly if config.IFCFGDIR does not exist + if not os.path.exists(config.IFCFGDIR): + return None + filename = "%s/ifcfg-%s" % (config.IFCFGDIR, interface) if os.path.exists(filename): ifcfg_file = ifcfg(filename) -- 2.8.3 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.xHGcKJ/_old 2016-06-02 12:39:20.000000000 +0200 +++ /var/tmp/diff_new_pack.xHGcKJ/_new 2016-06-02 12:39:20.000000000 +0200 @@ -1,7 +1,7 @@ <services> <service name="verify_file" mode="localonly"> - <param name="file">firewalld-0.4.1.2.tar.bz2</param> + <param name="file">firewalld-0.4.2.tar.bz2</param> <param name="verifier">sha1</param> - <param name="checksum">c7f3d04bd115b9a56a95fc7aee1a6d10559d2690</param> + <param name="checksum">d730129f592059ee97fc158861b44f8e7b201027</param> </service> </services> ++++++ firewalld-0.4.1.2.tar.bz2 -> firewalld-0.4.2.tar.bz2 ++++++ ++++ 111185 lines of diff (skipped)

1 0

commit xorg-x11-driver-input for openSUSE:Factory
by root＠hilbert.suse.de 02 Jun '16

02 Jun '16

Hello community, here is the log from the commit of package xorg-x11-driver-input for openSUSE:Factory checked in at 2016-06-02 12:39:09 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xorg-x11-driver-input (Old) and /work/SRC/openSUSE:Factory/.xorg-x11-driver-input.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "xorg-x11-driver-input" Changes: -------- --- /work/SRC/openSUSE:Factory/xorg-x11-driver-input/xorg-x11-driver-input.changes 2014-06-19 13:19:55.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.xorg-x11-driver-input.new/xorg-x11-driver-input.changes 2016-06-02 12:39:10.000000000 +0200 @@ -1,0 +2,8 @@ +Sun May 29 10:08:48 UTC 2016 - eich(a)suse.com + +- No longer require xf86-input-synaptics on systems later than Leap 42.1. + Instead require xf86-input-libinput. + People who will need the synaptics driver may install it by hand. + (boo#981750). + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xorg-x11-driver-input.spec ++++++ --- /var/tmp/diff_new_pack.aFB2WW/_old 2016-06-02 12:39:11.000000000 +0200 +++ /var/tmp/diff_new_pack.aFB2WW/_new 2016-06-02 12:39:11.000000000 +0200 @@ -1,7 +1,7 @@ # # spec file for package xorg-x11-driver-input # -# Copyright (c) 2014 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -30,7 +30,13 @@ Recommends: xf86-input-joystick Recommends: xf86-input-keyboard Recommends: xf86-input-mouse +## Most drivers can replaced by xf86-input-libinput today. Only keep +## the ones with lower priority or very specific device matching rules. +%if 0%{?suse_version} >= 1330 || (0%{?is_opensuse} && 0%{?sle_version} >= 120200) +Requires: xf86-input-libinput +%else Requires: xf86-input-synaptics +%endif ## only built on x86/x64 Recommends: xf86-input-vmmouse Requires: xf86-input-void

1 0

commit pcsc-lite for openSUSE:Factory
by root＠hilbert.suse.de 02 Jun '16

02 Jun '16

Hello community, here is the log from the commit of package pcsc-lite for openSUSE:Factory checked in at 2016-06-02 12:39:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/pcsc-lite (Old) and /work/SRC/openSUSE:Factory/.pcsc-lite.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "pcsc-lite" Changes: -------- --- /work/SRC/openSUSE:Factory/pcsc-lite/pcsc-lite.changes 2016-03-26 15:20:49.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.pcsc-lite.new/pcsc-lite.changes 2016-06-02 12:39:05.000000000 +0200 @@ -1,0 +2,9 @@ +Mon May 30 06:34:15 UTC 2016 - wr(a)rosenauer.org + +- Updated to version 1.8.17 + * Fix SCardEndTransaction() issue with a SCARD_SHARE_EXCLUSIVE connection + * Fix an issue when used with systemd (problem in signal handler) + * SCardGetAttrib(): set pcbAttrLen when buffer is too small + * Some other minor improvements + +------------------------------------------------------------------- Old: ---- pcsc-lite-1.8.16.tar.bz2 pcsc-lite-1.8.16.tar.bz2.asc New: ---- pcsc-lite-1.8.17.tar.bz2 pcsc-lite-1.8.17.tar.bz2.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ pcsc-lite.spec ++++++ --- /var/tmp/diff_new_pack.OVD09S/_old 2016-06-02 12:39:06.000000000 +0200 +++ /var/tmp/diff_new_pack.OVD09S/_new 2016-06-02 12:39:06.000000000 +0200 @@ -21,7 +21,7 @@ %define USER scard %define GROUP scard Name: pcsc-lite -Version: 1.8.16 +Version: 1.8.17 Release: 0 Summary: PCSC Smart Cards Library License: BSD-3-Clause ++++++ pcsc-lite-1.8.16.tar.bz2 -> pcsc-lite-1.8.17.tar.bz2 ++++++ ++++ 2471 lines of diff (skipped) ++++ retrying with extended exclude list diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/ChangeLog new/pcsc-lite-1.8.17/ChangeLog --- old/pcsc-lite-1.8.16/ChangeLog 2016-03-20 16:52:25.000000000 +0100 +++ new/pcsc-lite-1.8.17/ChangeLog 2016-05-29 14:14:24.000000000 +0200 @@ -1,3 +1,14 @@ +1.8.17: Ludovic Rousseau +29 May 2016 +- Fix SCardEndTransaction() issue with a SCARD_SHARE_EXCLUSIVE connection +- Fix an issue when used with systemd (problem in signal handler) +- SCardGetAttrib(): set pcbAttrLen when buffer is too small +- Doxygen: SCardGetAttrib() pbAttr can be NULL +- Doxygen: SCardGetAttrib() *pcbAttrLen contains the buffer size +- fix compilation warnings and link errors on SunOS +- Some other minor improvements + + 1.8.16: Ludovic Rousseau 20 March 2016 - SCardCancel() was not correctly handled diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/ChangeLog.git new/pcsc-lite-1.8.17/ChangeLog.git --- old/pcsc-lite-1.8.16/ChangeLog.git 2016-03-20 17:25:18.000000000 +0100 +++ new/pcsc-lite-1.8.17/ChangeLog.git 2016-05-29 14:15:18.000000000 +0200 @@ -1,4 +1,385 @@ -commit 55fa57fc691b732535fc3384a214b1daa133a127 (HEAD -> master, tag: pcsc-1.8.16, origin/master, origin/HEAD, github/master) +commit f74dc1feea4c7a2345abb3e1861b350d46946c86 (HEAD -> master, tag: pcsc-1.8.17, origin/master, origin/HEAD) +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Sun May 29 14:11:21 2016 +0200 + + Release 1.8.17 + + ChangeLog | 11 +++++++++++ + configure.ac | 2 +- + 2 files changed, 12 insertions(+), 1 deletion(-) + +commit 0ba8145d814b846f2f2c2c59ad82e34f1253159a +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Fri May 27 18:57:19 2016 +0200 + + Doxygen: improve SCardGetStatusChange example + + Show how to wait for a card insertion. + + src/winscard_clnt.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +commit 687128ad9a377a27bd93e542fc096530534dc101 +Author: Richard PALO <richard(a)NetBSD.org> +Date: Sat Apr 23 18:13:37 2016 +0200 + + Fix SunOS compilation error + + Avoid visibility issues on SunOS on either gcc or studio + by using a guard stipulating minimum versions for each compiler + needed to support __attribute__((visibility("hidden")) or equivalent + + src/misc.h | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +commit 9be0451909b73a4f52e42c01915683954d7d0a84 +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Sat May 7 11:54:14 2016 +0200 + + Fix end of function comment + + src/debuglog.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit f3a6ccac63abd4d7d0e4eeced059128919286bab +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Fri May 20 17:07:03 2016 +0200 + + Unit Test for 74656f24 + + SCardEndTransaction(): no card action in a transaction + + UnitaryTests/SCardBeginTransaction_Reset.py | 85 +++++++++++++++++++++++++++++ + 1 file changed, 85 insertions(+) + +commit 74656f24db3da1532040a1775ceffa225fbc3d00 +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Fri May 20 17:02:40 2016 +0200 + + SCardEndTransaction(): no card action in a transaction + + If a transaction is ongoing then another SCardEndTransaction() should + not reset or unpower the card. + In that case SCARD_E_SHARING_VIOLATION is returned and the transaction + is not ended. + + src/winscard.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +commit b7a4f8f47c1c57b56dfe6cd1088f68b845016d9b +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Fri May 20 16:19:56 2016 +0200 + + RFUnlockSharing: handle SCARD_SHARE_EXCLUSIVE + + When a card is connected using SCARD_SHARE_EXCLUSIVE then + RFUnlockSharing() called by SCardEndTransaction() should not be able to + remove the exclusive access. + + The bug was detected because the following sequence worked but should + not: + SCardConnect(..., SCARD_SHARE_EXCLUSIVE, ...); + SCardEndTransaction(); + + An error was reported only on the second SCardEndTransaction() call. + + Now the first call to SCardEndTransaction() will fail and the card + connection will stay exclusive. + + Thanks to Christophe Ferrando for the bug report in "[Pcsclite-muscle] + SCARD_E_NOT_TRANSACTED" + http://lists.alioth.debian.org/pipermail/pcsclite-muscle/Week-of-Mon-201605… + + src/readerfactory.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +commit 88b2085b9c60c7a99aa1306187ad77ce1670a8eb +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Fri May 20 15:39:20 2016 +0200 + + SCardGetAttrib.py: display the values in ASCII + + Display the attributes values also in ASCII. + + The output is now something like: + PC/SC Readers: ['Gemalto PC Twin Reader (70D7E2EE) 00 00'] + reader: Gemalto PC Twin Reader (70D7E2EE) 00 00 + 0x10103 [55, 48, 68, 55, 69, 50, 69, 69, 0] 37 30 44 37 45 32 45 45 00 + 70D7E2EE + 0x90303 [59, 167, 0, 64, 24, 128, 101, 162, 8, 1, 1, 82] 3B A7 00 40 18 + 80 65 A2 08 01 01 52 ;�@�eR + + UnitaryTests/SCardGetAttrib.py | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +commit b1effd21528d27dfa016c2752cf3e4cb973240f4 +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Fri Apr 22 15:45:01 2016 +0200 + + pcscd.h.in: remove extra spaces + + src/pcscd.h.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +commit 77740786d5450273fad1400322918f5a276b3131 +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Mon Apr 25 11:31:44 2016 +0200 + + SCardGetAttrib.py: also use SCARD_ATTR_ATR_STRING + + Try to use both attributes SCARD_ATTR_VENDOR_IFD_SERIAL_NO and + SCARD_ATTR_ATR_STRING + + Not all devices have a serial number so SCARD_ATTR_VENDOR_IFD_SERIAL_NO + may just return an empty buffer. + + SCARD_ATTR_ATR_STRING should always work when a card is inserted (and + the CCID driver is used). + + UnitaryTests/SCardGetAttrib.py | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +commit fa52ae4e1f1ae3c35596e9aedaa3ce30fc5ceef9 +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Sun Apr 24 19:04:04 2016 +0200 + + Fix use of d_type field on SunOS + + SunOS does not provide the d_type field in a directory entry. + + The code now checks that d_type is available using + AC_STRUCT_DIRENT_D_TYPE and use it conditionnaly. + + Fix compilation error on SunOS: + configfile.l: In function 'DBGetReaderListDir': + configfile.l:293:16: error: 'struct dirent' has no member named 'd_type' + if (direntry->d_type == DT_UNKNOWN) + ^ + configfile.l:293:28: error: 'DT_UNKNOWN' undeclared (first use in this function) + if (direntry->d_type == DT_UNKNOWN) + ^ + configfile.l:293:28: note: each undeclared identifier is reported only once for each function it appears in + configfile.l:312:17: error: 'struct dirent' has no member named 'd_type' + if (direntry->d_type != DT_REG) + ^ + configfile.l:312:29: error: 'DT_REG' undeclared (first use in this function) + if (direntry->d_type != DT_REG) + ^ + + Thanks to risto3 for the bug report + https://github.com/LudovicRousseau/PCSC/issues/6 + + configure.ac | 1 + + src/configfile.l | 4 ++++ + 2 files changed, 5 insertions(+) + +commit 88acbfa03b98f28567c2438ea7aca6447488c0af +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Sun Apr 24 18:55:45 2016 +0200 + + Fix compiler warnings on SunOS + + utils.c: In function 'SendHotplugSignal': + utils.c:97:3: warning: format '%d' expects argument of type 'int', but argument 6 has type 'pid_t' [-Wformat=] + Log2(PCSC_LOG_INFO, "Send hotplug signal to pcscd (pid=%d)", pid); + ^ + utils.c:100:4: warning: format '%d' expects argument of type 'int', but argument 6 has type 'pid_t' [-Wformat=] + Log3(PCSC_LOG_CRITICAL, "Can't signal pcscd (pid=%d): %s", + ^ + + src/utils.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +commit 2360debebf1c35c8599cd2e0fc484e5f5029ab87 +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Sun Apr 24 18:52:45 2016 +0200 + + Fix compiler warning on SunOS + + pcscdaemon.c: In function 'main': + pcscdaemon.c:402:5: warning: format '%d' expects argument of type 'int', but argument 6 has type 'pid_t' [-Wformat=] + Log2(PCSC_LOG_CRITICAL, + ^ + + src/pcscdaemon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit abe436e38aa58cb1140eff0d497ba721474c7703 +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Sun Apr 24 18:46:53 2016 +0200 + + Fix signal handler by using only allowed functions + + The signals are now treated in a special thread created just for that purpose. + + Thanks to Andre Florath for the bug report + https://lists.alioth.debian.org/pipermail/pcsclite-muscle/Week-of-Mon-20160… + + [Pcsclite-muscle] pcscd jams when using '--auto-exit' + + Andre Florath andre at florath.net + Sat Apr 9 06:06:44 UTC 2016 + + Hello! + + Since some time I have problems with pcscd. I'm using pcscd in + conjunction with online banking and after a short period of working it + stops and jams the banking application. + + A 'strace' to the pcscd showed that it is still running somewhere + deep in the USB stack. + + The problem is, when manually running the the pcscd, there is no + problem at all - only when running from systemd. + Therefore I searched for the differences and found one: the + '--auto-exit'. Downloaded the source and had a closer look. + + What I understand from the source code is, that when '--auto-exit' is + given, a SIGALRM is generated which (should) terminate the process. + + I have noticed that the signal handler 'signal_trap()' uses some + function calls that are not allowed in signal handlers; like: + * syslog() + * gettimeofday() + * remove() + + Using this creates undefined behavior. + (Please see 'man 7 signal' for a complete list of system calls that + are not allowed in signal handlers.) + + I found a workaround for the issue. + Changed the service file to: + + === + [Unit] + Description=PC/SC Smart Card Daemon + + [Service] + ExecStart=/usr/sbin/pcscd --foreground --debug -a + ExecReload=/usr/sbin/pcscd --hotplug + + [Install] + Also=pcscd.socket + === + + and disabling the pcscd.socket gives me a stable system. + (Yes - pcscd is now started at boot time and runs the whole time + - which is fine for me.) + + If you need more information, please drop me a note. + + Kind regards + + Andre + + src/pcscdaemon.c | 170 ++++++++++++++++++++++++++++++++++++------------------- + 1 file changed, 111 insertions(+), 59 deletions(-) + +commit b48ff146f979cd3323845e1c19d1c1629d2ae037 +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Sun Apr 24 18:25:03 2016 +0200 + + Check alloca(3) is available + + The code uses alloca(3) so we check in ./configure that this function is + available. + + configure.ac | 1 + + 1 file changed, 1 insertion(+) + +commit 890f7edbd931467fd381739257ac1e1f335eb64a +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Sat Apr 23 15:57:46 2016 +0200 + + readerfactory: fix compilation warning on SunOS + + The code uses alloca() so we #include "alloca.h" + + readerfactory.c: In function 'RFAddReader': + readerfactory.c:211:2: warning: implicit declaration of function 'alloca' [-Wimplicit-function-declaration] + readerName = alloca(strlen(readerNameLong)+1); + ^ + readerfactory.c:211:15: warning: incompatible implicit declaration of built-in function 'alloca' + readerName = alloca(strlen(readerNameLong)+1); + ^ + + src/readerfactory.c | 1 + + 1 file changed, 1 insertion(+) + +commit 2269f10c2d2c5be1308d59469722024650a19b6d +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Wed Apr 13 18:29:53 2016 +0200 + + SCardConnect(): fix a Valgrind warning + + ==19635== Memcheck, a memory error detector + ==19635== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al. + ==19635== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info + ==19635== Command: /usr/rtests/bin/Pkcs11UnitTest.X64 pkcs11_common + ==19635== + Running pkcs11_common + pkcs11_common::testGetInfo==19635== Syscall param socketcall.sendto(msg) points to uninitialised byte(s) + ==19635== at 0x605A1F7: send (send.c:32) + ==19635== by 0xBC47CE6: ??? (in /lib/x86_64-linux-gnu/libpcsclite.so.1.0.0) + ==19635== by 0xBC47E22: ??? (in /lib/x86_64-linux-gnu/libpcsclite.so.1.0.0) + ==19635== by 0xBC43BBE: SCardConnect (in /lib/x86_64-linux-gnu/libpcsclite.so.1.0.0) + ... + + The field scConnectStruct.szReader (containing the reader name) was not + completely initialized. + + Thanks to Andrey Roussev for the patch + https://lists.alioth.debian.org/pipermail/pcsclite-muscle/Week-of-Mon-20160… + + src/winscard_clnt.c | 1 + + 1 file changed, 1 insertion(+) + +commit d6c7215335fe04abfd91206349c7d674de7bfcaa +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Thu Mar 31 16:43:16 2016 +0200 + + Doxygen: SCardGetAttrib() *pcbAttrLen contains the buffer size + + On return *pcbAttrLen contains the actual length of the received + attribute. + + If the buffer was not big enough the error SCARD_E_INSUFFICIENT_BUFFER + is returned and *pcbAttrLen contains the expected size. + + src/winscard_clnt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +commit e64629f80a4639836399493ef5c3c717571ffc96 +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Thu Mar 31 16:11:44 2016 +0200 + + SCardGetAttrib(): set pcbAttrLen when buffer is too small + + When the user provides a pbAttr[] buffer too small then the error code + SCARD_E_INSUFFICIENT_BUFFER is returned and the correct buffer size + value is set in pcbAttrLen. + + Before the change the value of pcbAttrLen was not changed so the user + had no idea what the correct value should be. + + src/winscard_clnt.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +commit 84a9441d52e72e1fbec6aa2b0dd6db27d3f5ce38 +Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> +Date: Thu Mar 31 11:42:39 2016 +0200 + + Doxygen: SCardGetAttrib() pbAttr can be NULL + + If pbAttr is NULL then the correct buffer size is indicated in + pcbAttrLen. + + Also modify the example to use the double call. + + src/winscard_clnt.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +commit 55fa57fc691b732535fc3384a214b1daa133a127 (tag: pcsc-1.8.16, github/master) Author: Ludovic Rousseau <ludovic.rousseau(a)free.fr> Date: Sun Mar 20 16:57:30 2016 +0100 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/config.h.in new/pcsc-lite-1.8.17/config.h.in --- old/pcsc-lite-1.8.16/config.h.in 2016-03-20 16:19:57.000000000 +0100 +++ new/pcsc-lite-1.8.17/config.h.in 2016-05-29 14:14:55.000000000 +0200 @@ -6,12 +6,31 @@ /* display ATR parsing debug messages. */ #undef ATR_DEBUG +/* Define to one of `_getb67', `GETB67', `getb67' for Cray-2 and Cray-YMP + systems. This function is required for `alloca.c' support on those systems. + */ +#undef CRAY_STACKSEG_END + +/* Define to 1 if using `alloca.c'. */ +#undef C_ALLOCA + /* Filter reader names */ #undef FILTER_NAMES +/* Define to 1 if you have `alloca', as a function or macro. */ +#undef HAVE_ALLOCA + +/* Define to 1 if you have <alloca.h> and it should be used (not on Ultrix). + */ +#undef HAVE_ALLOCA_H + /* Define to 1 if you have the `daemon' function. */ #undef HAVE_DAEMON +/* Define to 1 if you have the <dirent.h> header file, and it defines `DIR'. + */ +#undef HAVE_DIRENT_H + /* Define to 1 if you have the <dlfcn.h> header file. */ #undef HAVE_DLFCN_H @@ -54,6 +73,9 @@ /* Define to 1 if you have the `nanosleep' function. */ #undef HAVE_NANOSLEEP +/* Define to 1 if you have the <ndir.h> header file, and it defines `DIR'. */ +#undef HAVE_NDIR_H + /* Build polkit access control support */ #undef HAVE_POLKIT @@ -85,12 +107,23 @@ /* Define to 1 if you have the <string.h> header file. */ #undef HAVE_STRING_H +/* Define to 1 if `d_type' is a member of `struct dirent'. */ +#undef HAVE_STRUCT_DIRENT_D_TYPE + /* Define to 1 if you have the <syslog.h> header file. */ #undef HAVE_SYSLOG_H +/* Define to 1 if you have the <sys/dir.h> header file, and it defines `DIR'. + */ +#undef HAVE_SYS_DIR_H + /* Define to 1 if you have the <sys/filio.h> header file. */ #undef HAVE_SYS_FILIO_H +/* Define to 1 if you have the <sys/ndir.h> header file, and it defines `DIR'. + */ +#undef HAVE_SYS_NDIR_H + /* Define to 1 if you have the <sys/stat.h> header file. */ #undef HAVE_SYS_STAT_H @@ -156,6 +189,14 @@ your system. */ #undef PTHREAD_CREATE_JOINABLE +/* If using the C implementation of alloca, define if you know the + direction of stack growth for your system; otherwise it will be + automatically deduced at runtime. + STACK_DIRECTION > 0 => grows toward higher addresses + STACK_DIRECTION < 0 => grows toward lower addresses + STACK_DIRECTION = 0 => direction of growth unknown */ +#undef STACK_DIRECTION + /* Define to 1 if you have the ANSI C header files. */ #undef STDC_HEADERS diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/configure.ac new/pcsc-lite-1.8.17/configure.ac --- old/pcsc-lite-1.8.16/configure.ac 2016-03-20 16:52:25.000000000 +0100 +++ new/pcsc-lite-1.8.17/configure.ac 2016-05-29 14:14:24.000000000 +0200 @@ -3,7 +3,7 @@ AC_PREREQ([2.69]) -AC_INIT([pcsc-lite],[1.8.16]) +AC_INIT([pcsc-lite],[1.8.17]) AC_CONFIG_SRCDIR(src/pcscdaemon.c) AM_INIT_AUTOMAKE(1.8 dist-bzip2 no-dist-gzip) AC_CONFIG_HEADERS([config.h]) @@ -101,12 +101,14 @@ AC_TYPE_UID_T AC_TYPE_SIZE_T AC_HEADER_TIME +AC_STRUCT_DIRENT_D_TYPE # Checks for library functions AC_FUNC_ERROR_AT_LINE AC_FUNC_STAT AC_FUNC_VPRINTF AC_CHECK_FUNCS(daemon flock getopt_long nanosleep strerror vsnprintf) +AC_FUNC_ALLOCA # C Compiler features AC_C_INLINE diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/src/PCSC/pcsclite.h new/pcsc-lite-1.8.17/src/PCSC/pcsclite.h --- old/pcsc-lite-1.8.16/src/PCSC/pcsclite.h 2016-03-20 16:41:26.000000000 +0100 +++ new/pcsc-lite-1.8.17/src/PCSC/pcsclite.h 2016-05-29 14:15:09.000000000 +0200 @@ -279,7 +279,7 @@ #define INFINITE 0xFFFFFFFF /**< Infinite timeout */ #endif -#define PCSCLITE_VERSION_NUMBER "1.8.16" /**< Current version */ +#define PCSCLITE_VERSION_NUMBER "1.8.17" /**< Current version */ /** Maximum readers context (a slot is count as a reader) */ #define PCSCLITE_MAX_READERS_CONTEXTS 16 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/src/configfile.c new/pcsc-lite-1.8.17/src/configfile.c --- old/pcsc-lite-1.8.16/src/configfile.c 2015-11-18 16:50:24.000000000 +0100 +++ new/pcsc-lite-1.8.17/src/configfile.c 2016-05-29 14:16:07.000000000 +0200 @@ -7,8 +7,8 @@ #define FLEX_SCANNER #define YY_FLEX_MAJOR_VERSION 2 -#define YY_FLEX_MINOR_VERSION 5 -#define YY_FLEX_SUBMINOR_VERSION 39 +#define YY_FLEX_MINOR_VERSION 6 +#define YY_FLEX_SUBMINOR_VERSION 0 #if YY_FLEX_SUBMINOR_VERSION > 0 #define FLEX_BETA #endif @@ -210,7 +210,7 @@ /* Number of characters read into yy_ch_buf, not including EOB * characters. */ - yy_size_t yy_n_chars; + int yy_n_chars; /* Whether we "own" the buffer - i.e., we know we created it, * and can realloc() it to grow it, and should free() it to @@ -280,7 +280,7 @@ /* yy_hold_char holds the character lost when yytext is formed. */ static char yy_hold_char; -static yy_size_t yy_n_chars; /* number of characters read into yy_ch_buf */ +static int yy_n_chars; /* number of characters read into yy_ch_buf */ yy_size_t yyleng; /* Points to current character in buffer. */ @@ -341,7 +341,7 @@ /* Begin user sect3 */ -#define yywrap() 1 +#define yywrap() (/*CONSTCOND*/1) #define YY_SKIP_YYWRAP typedef unsigned char YY_CHAR; @@ -355,11 +355,17 @@ int yylineno = 1; extern char *yytext; +#ifdef yytext_ptr +#undef yytext_ptr +#endif #define yytext_ptr yytext static yy_state_type yy_get_previous_state (void ); static yy_state_type yy_try_NUL_trans (yy_state_type current_state ); static int yy_get_next_buffer (void ); +#if defined(__GNUC__) && __GNUC__ >= 3 +__attribute__((__noreturn__)) +#endif static void yy_fatal_error (yyconst char msg[] ); /* Done after the current pattern has been matched and before the @@ -387,7 +393,7 @@ 0, 3, 1, 0, 5, 0 } ; -static yyconst flex_int32_t yy_ec[256] = +static yyconst YY_CHAR yy_ec[256] = { 0, 1, 1, 1, 1, 1, 1, 1, 1, 2, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, @@ -419,12 +425,12 @@ 1, 1, 1, 1, 1 } ; -static yyconst flex_int32_t yy_meta[11] = +static yyconst YY_CHAR yy_meta[11] = { 0, 1, 1, 2, 1, 1, 1, 1, 1, 1, 1 } ; -static yyconst flex_int16_t yy_base[20] = +static yyconst flex_uint16_t yy_base[20] = { 0, 0, 0, 15, 31, 31, 31, 8, 0, 10, 10, 18, 31, 0, 20, 0, 31, 26, 13, 28 @@ -436,7 +442,7 @@ 17, 16, 18, 19, 10, 0, 16, 16, 16 } ; -static yyconst flex_int16_t yy_nxt[42] = +static yyconst flex_uint16_t yy_nxt[42] = { 0, 4, 5, 6, 7, 8, 9, 10, 10, 10, 10, 12, 12, 12, 13, 16, 12, 15, 15, 15, 15, @@ -531,7 +537,7 @@ void tok_error(char *pcToken_error); #define YY_NO_INPUT 1 -#line 535 "configfile.c" +#line 541 "configfile.c" #define INITIAL 0 @@ -564,11 +570,11 @@ FILE *yyget_in (void ); -void yyset_in (FILE * in_str ); +void yyset_in (FILE * _in_str ); FILE *yyget_out (void ); -void yyset_out (FILE * out_str ); +void yyset_out (FILE * _out_str ); yy_size_t yyget_leng (void ); @@ -576,7 +582,7 @@ int yyget_lineno (void ); -void yyset_lineno (int line_number ); +void yyset_lineno (int _line_number ); /* Macros after this point can all be overridden by user definitions in * section 1. @@ -590,6 +596,10 @@ #endif #endif +#ifndef YY_NO_UNPUT + +#endif + #ifndef yytext_ptr static void yy_flex_strncpy (char *,yyconst char *,int ); #endif @@ -702,7 +712,7 @@ /* Code executed at the end of each rule. */ #ifndef YY_BREAK -#define YY_BREAK break; +#define YY_BREAK /*LINTED*/break; #endif #define YY_RULE_SETUP \ @@ -712,9 +722,9 @@ */ YY_DECL { - register yy_state_type yy_current_state; - register char *yy_cp, *yy_bp; - register int yy_act; + yy_state_type yy_current_state; + char *yy_cp, *yy_bp; + int yy_act; if ( !(yy_init) ) { @@ -746,9 +756,9 @@ #line 69 "configfile.l" -#line 750 "configfile.c" +#line 760 "configfile.c" - while ( 1 ) /* loops until end-of-file is reached */ + while ( /*CONSTCOND*/1 ) /* loops until end-of-file is reached */ { yy_cp = (yy_c_buf_p); @@ -764,7 +774,7 @@ yy_match: do { - register YY_CHAR yy_c = yy_ec[YY_SC_TO_UI(*yy_cp)] ; + YY_CHAR yy_c = yy_ec[YY_SC_TO_UI(*yy_cp)] ; if ( yy_accept[yy_current_state] ) { (yy_last_accepting_state) = yy_current_state; @@ -840,7 +850,7 @@ #line 77 "configfile.l" ECHO; YY_BREAK -#line 844 "configfile.c" +#line 854 "configfile.c" case YY_STATE_EOF(INITIAL): yyterminate(); @@ -983,9 +993,9 @@ */ static int yy_get_next_buffer (void) { - register char *dest = YY_CURRENT_BUFFER_LVALUE->yy_ch_buf; - register char *source = (yytext_ptr); - register int number_to_move, i; + char *dest = YY_CURRENT_BUFFER_LVALUE->yy_ch_buf; + char *source = (yytext_ptr); + yy_size_t number_to_move, i; int ret_val; if ( (yy_c_buf_p) > &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars) + 1] ) @@ -1014,7 +1024,7 @@ /* Try to read more data. */ /* First move last chars to start of buffer. */ - number_to_move = (int) ((yy_c_buf_p) - (yytext_ptr)) - 1; + number_to_move = (yy_size_t) ((yy_c_buf_p) - (yytext_ptr)) - 1; for ( i = 0; i < number_to_move; ++i ) *(dest++) = *(source++); @@ -1096,9 +1106,9 @@ else ret_val = EOB_ACT_CONTINUE_SCAN; - if ((yy_size_t) ((yy_n_chars) + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) { + if ((int) ((yy_n_chars) + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) { /* Extend the array by 50%, plus the number we really need. */ - yy_size_t new_size = (yy_n_chars) + number_to_move + ((yy_n_chars) >> 1); + int new_size = (yy_n_chars) + number_to_move + ((yy_n_chars) >> 1); YY_CURRENT_BUFFER_LVALUE->yy_ch_buf = (char *) yyrealloc((void *) YY_CURRENT_BUFFER_LVALUE->yy_ch_buf,new_size ); if ( ! YY_CURRENT_BUFFER_LVALUE->yy_ch_buf ) YY_FATAL_ERROR( "out of dynamic memory in yy_get_next_buffer()" ); @@ -1117,14 +1127,14 @@ static yy_state_type yy_get_previous_state (void) { - register yy_state_type yy_current_state; - register char *yy_cp; + yy_state_type yy_current_state; + char *yy_cp; yy_current_state = (yy_start); for ( yy_cp = (yytext_ptr) + YY_MORE_ADJ; yy_cp < (yy_c_buf_p); ++yy_cp ) { - register YY_CHAR yy_c = (*yy_cp ? yy_ec[YY_SC_TO_UI(*yy_cp)] : 1); + YY_CHAR yy_c = (*yy_cp ? yy_ec[YY_SC_TO_UI(*yy_cp)] : 1); if ( yy_accept[yy_current_state] ) { (yy_last_accepting_state) = yy_current_state; @@ -1149,10 +1159,10 @@ */ static yy_state_type yy_try_NUL_trans (yy_state_type yy_current_state ) { - register int yy_is_jam; - register char *yy_cp = (yy_c_buf_p); + int yy_is_jam; + char *yy_cp = (yy_c_buf_p); - register YY_CHAR yy_c = 1; + YY_CHAR yy_c = 1; if ( yy_accept[yy_current_state] ) { (yy_last_accepting_state) = yy_current_state; @@ -1170,6 +1180,10 @@ return yy_is_jam ? 0 : yy_current_state; } +#ifndef YY_NO_UNPUT + +#endif + #ifndef YY_NO_INPUT #ifdef __cplusplus static int yyinput (void) @@ -1319,7 +1333,7 @@ if ( ! b ) YY_FATAL_ERROR( "out of dynamic memory in yy_create_buffer()" ); - b->yy_buf_size = size; + b->yy_buf_size = (yy_size_t)size; /* yy_ch_buf has to be 2 characters longer than the size given because * we need to put in 2 end-of-buffer characters. @@ -1474,7 +1488,7 @@ * scanner will even need a stack. We use 2 instead of 1 to avoid an * immediate realloc on the next call. */ - num_to_alloc = 1; + num_to_alloc = 1; /* After all that talk, this was set to 1 anyways... */ (yy_buffer_stack) = (struct yy_buffer_state**)yyalloc (num_to_alloc * sizeof(struct yy_buffer_state*) ); @@ -1491,7 +1505,7 @@ if ((yy_buffer_stack_top) >= ((yy_buffer_stack_max)) - 1){ /* Increase the buffer to prepare for a possible push. */ - int grow_size = 8 /* arbitrary grow size */; + yy_size_t grow_size = 8 /* arbitrary grow size */; num_to_alloc = (yy_buffer_stack_max) + grow_size; (yy_buffer_stack) = (struct yy_buffer_state**)yyrealloc @@ -1599,7 +1613,7 @@ static void yy_fatal_error (yyconst char* msg ) { - (void) fprintf( stderr, "%s\n", msg ); + (void) fprintf( stderr, "%s\n", msg ); exit( YY_EXIT_FAILURE ); } @@ -1665,29 +1679,29 @@ } /** Set the current line number. - * @param line_number + * @param _line_number line number * */ -void yyset_lineno (int line_number ) +void yyset_lineno (int _line_number ) { - yylineno = line_number; + yylineno = _line_number; } /** Set the input stream. This does not discard the current * input buffer. - * @param in_str A readable stream. + * @param _in_str A readable stream. * * @see yy_switch_to_buffer */ -void yyset_in (FILE * in_str ) +void yyset_in (FILE * _in_str ) { - yyin = in_str ; + yyin = _in_str ; } -void yyset_out (FILE * out_str ) +void yyset_out (FILE * _out_str ) { - yyout = out_str ; + yyout = _out_str ; } int yyget_debug (void) @@ -1695,9 +1709,9 @@ return yy_flex_debug; } -void yyset_debug (int bdebug ) +void yyset_debug (int _bdebug ) { - yy_flex_debug = bdebug ; + yy_flex_debug = _bdebug ; } static int yy_init_globals (void) @@ -1757,7 +1771,8 @@ #ifndef yytext_ptr static void yy_flex_strncpy (char* s1, yyconst char * s2, int n ) { - register int i; + + int i; for ( i = 0; i < n; ++i ) s1[i] = s2[i]; } @@ -1766,7 +1781,7 @@ #ifdef YY_NEED_STRLEN static int yy_flex_strlen (yyconst char * s ) { - register int n; + int n; for ( n = 0; s[n]; ++n ) ; @@ -1776,11 +1791,12 @@ void *yyalloc (yy_size_t size ) { - return (void *) malloc( size ); + return (void *) malloc( size ); } void *yyrealloc (void * ptr, yy_size_t size ) { + /* The cast to (char *) in the following accommodates both * implementations that use char* generic pointers, and those * that use void* generic pointers. It works with the latter @@ -1793,12 +1809,12 @@ void yyfree (void * ptr ) { - free( (char *) ptr ); /* see yyrealloc() for (char *) cast */ + free( (char *) ptr ); /* see yyrealloc() for (char *) cast */ } #define YYTABLES_NAME "yytables" -#line 76 "configfile.l" +#line 77 "configfile.l" @@ -2016,7 +2032,9 @@ readerconf_dir, direntry->d_name); /* skip non regular files */ +#ifdef HAVE_STRUCT_DIRENT_D_TYPE if (direntry->d_type == DT_UNKNOWN) +#endif { struct stat st; @@ -2035,7 +2053,9 @@ } } else +#ifdef HAVE_STRUCT_DIRENT_D_TYPE if (direntry->d_type != DT_REG) +#endif { Log2(PCSC_LOG_DEBUG, "Skipping non regular file: %s", direntry->d_name); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/src/configfile.l new/pcsc-lite-1.8.17/src/configfile.l --- old/pcsc-lite-1.8.16/src/configfile.l 2015-11-06 09:39:51.000000000 +0100 +++ new/pcsc-lite-1.8.17/src/configfile.l 2016-05-06 13:16:10.000000000 +0200 @@ -290,7 +290,9 @@ readerconf_dir, direntry->d_name); /* skip non regular files */ +#ifdef HAVE_STRUCT_DIRENT_D_TYPE if (direntry->d_type == DT_UNKNOWN) +#endif { struct stat st; @@ -309,7 +311,9 @@ } } else +#ifdef HAVE_STRUCT_DIRENT_D_TYPE if (direntry->d_type != DT_REG) +#endif { Log2(PCSC_LOG_DEBUG, "Skipping non regular file: %s", direntry->d_name); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/src/debuglog.c new/pcsc-lite-1.8.17/src/debuglog.c --- old/pcsc-lite-1.8.16/src/debuglog.c 2015-11-06 09:39:51.000000000 +0100 +++ new/pcsc-lite-1.8.17/src/debuglog.c 2016-05-20 19:44:43.000000000 +0200 @@ -192,7 +192,7 @@ } fflush(stdout); } -} /* log_msg */ +} /* log_line */ static void log_xxd_always(const int priority, const char *msg, const unsigned char *buffer, const int len) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/src/misc.h new/pcsc-lite-1.8.17/src/misc.h --- old/pcsc-lite-1.8.16/src/misc.h 2015-11-06 09:39:51.000000000 +0100 +++ new/pcsc-lite-1.8.17/src/misc.h 2016-05-29 14:14:24.000000000 +0200 @@ -40,10 +40,12 @@ * see http://gcc.gnu.org/onlinedocs/gcc-3.3.5/gcc/Function-Attributes.html#Functi… * see http://www.nedprod.com/programs/gccvisibility.html */ -#if defined __GNUC__ && (! defined (__sun)) && (__GNUC__ >= 4 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 3)) +#if defined(__GNUC__) && \ + (__GNUC__ >= 4 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 3)) || \ + defined(__SUNPRO_C) && __SUNPRO_C >= 0x590 #define INTERNAL __attribute__ ((visibility("hidden"))) #define PCSC_API __attribute__ ((visibility("default"))) -#elif (! defined __GNUC__ ) && defined (__sun) +#elif defined(__SUNPRO_C) && __SUNPRO_C >= 0x550 /* http://wikis.sun.com/display/SunStudio/Macros+for+Shared+Library+Symbol+Vis… */ #define INTERNAL __hidden #define PCSC_API __global diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/src/pcscd.h new/pcsc-lite-1.8.17/src/pcscd.h --- old/pcsc-lite-1.8.16/src/pcscd.h 2016-03-20 16:41:26.000000000 +0100 +++ new/pcsc-lite-1.8.17/src/pcscd.h 2016-05-29 14:15:09.000000000 +0200 @@ -7,7 +7,7 @@ * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright @@ -15,7 +15,7 @@ * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. @@ -49,7 +49,7 @@ #define PCSCLITE_CSOCK_NAME PCSCLITE_IPC_DIR "/pcscd.comm" -#define PCSCLITE_VERSION_NUMBER "1.8.16" /**< Current version */ +#define PCSCLITE_VERSION_NUMBER "1.8.17" /**< Current version */ #define PCSCLITE_STATUS_POLL_RATE 400000 /**< Status polling rate */ #define PCSCLITE_LOCK_POLL_RATE 100000 /**< Lock polling rate */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/src/pcscd.h.in new/pcsc-lite-1.8.17/src/pcscd.h.in --- old/pcsc-lite-1.8.16/src/pcscd.h.in 2016-03-12 20:03:09.000000000 +0100 +++ new/pcsc-lite-1.8.17/src/pcscd.h.in 2016-05-20 19:44:43.000000000 +0200 @@ -7,7 +7,7 @@ * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright @@ -15,7 +15,7 @@ * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/src/pcscdaemon.c new/pcsc-lite-1.8.17/src/pcscdaemon.c --- old/pcsc-lite-1.8.16/src/pcscdaemon.c 2016-03-12 20:03:09.000000000 +0100 +++ new/pcsc-lite-1.8.17/src/pcscdaemon.c 2016-05-06 13:16:10.000000000 +0200 @@ -81,6 +81,7 @@ static int ExitValue = EXIT_FAILURE; int HPForceReaderPolling = 0; static int pipefd[] = {-1, -1}; +static int signal_handler_fd[] = {-1, -1}; char Add_Serial_In_Name = TRUE; char Add_Interface_In_Name = TRUE; @@ -89,7 +90,6 @@ */ static void at_exit(void); static void clean_temp_files(void); -static void signal_reload(int sig); static void signal_trap(int); static void print_version (void); static void print_usage (char const * const); @@ -152,6 +152,10 @@ /* Nothing to do in case of a syscall interrupted * It happens when SIGUSR1 (reload) or SIGINT (Ctrl-C) is received * We just try again */ + + /* we wait a bit so that the signal handler thread can do + * its job and set AraKiri if needed */ + SYS_USleep(1000); break; default: @@ -162,6 +166,93 @@ } } +/** + * thread dedicated to handle signals + * + * a signal handler can not call any function. See signal(7) for a list + * of function that are safe to call from a signal handler. + * The functions syslog(), gettimeofday() and remove() are NOT safe. + */ +static void *signal_thread(void *arg) +{ + (void)arg; + + while (TRUE) + { + int r; + int sig; + + r = read(signal_handler_fd[0], &sig, sizeof sig); + if (r < 0) + { + Log2(PCSC_LOG_ERROR, "read failed: %s", strerror(errno)); + return NULL; + } + + Log2(PCSC_LOG_INFO, "Received signal: %d", sig); + + /* signal for hotplug */ + if (SIGUSR1 == sig) + { +#ifdef USE_USB + if (! AraKiri) + HPReCheckSerialReaders(); +#endif + /* Reenable the signal handler. + * This is needed on Solaris and HPUX. */ + (void)signal(SIGUSR1, signal_trap); + + continue; + } + + /* do not wait if asked to terminate + * avoids waiting after the reader(s) in shutdown for example */ + if (SIGTERM == sig) + { + Log1(PCSC_LOG_INFO, "Direct suicide"); + at_exit(); + } + + if (SIGALRM == sig) + { + /* normal exit without error */ + ExitValue = EXIT_SUCCESS; + } + + /* the signal handler is called several times for the same Ctrl-C */ + if (AraKiri == FALSE) + { + Log1(PCSC_LOG_INFO, "Preparing for suicide"); + AraKiri = TRUE; + + /* if still in the init/loading phase the AraKiri will not be + * seen by the main event loop + */ + if (Init) + { + Log1(PCSC_LOG_INFO, "Suicide during init"); + at_exit(); + } + } + else + { + /* if pcscd do not want to die */ + static int lives = 2; + + lives--; + /* no live left. Something is blocking the normal death. */ + if (0 == lives) + { + Log1(PCSC_LOG_INFO, "Forced suicide"); + at_exit(); + } + } + } + + return NULL; +} + + int main(int argc, char **argv) { int rv; @@ -400,7 +491,7 @@ Log1(PCSC_LOG_CRITICAL, "file " PCSCLITE_CSOCK_NAME " already exists."); Log2(PCSC_LOG_CRITICAL, - "Another pcscd (pid: %d) seems to be running.", pid); + "Another pcscd (pid: %ld) seems to be running.", (long)pid); return EXIT_FAILURE; } else @@ -515,6 +606,20 @@ /* exits on SIGALARM to allow pcscd to suicide if not used */ (void)signal(SIGALRM, signal_trap); + if (pipe(signal_handler_fd) == -1) + { + Log2(PCSC_LOG_CRITICAL, "pipe() failed: %s", strerror(errno)); + return EXIT_FAILURE; + } + + pthread_t signal_handler_thread; + rv = pthread_create(&signal_handler_thread, NULL, signal_thread, NULL); + if (rv) + { + Log2(PCSC_LOG_CRITICAL, "pthread_create failed: %s", strerror(rv)); + return EXIT_FAILURE; + } + /* * If PCSCLITE_IPC_DIR does not exist then create it */ @@ -610,7 +715,7 @@ /* * Hotplug rescan */ - (void)signal(SIGUSR1, signal_reload); + (void)signal(SIGUSR1, signal_trap); /* * Initialize the comm structure @@ -730,66 +835,13 @@ strerror(errno)); } -static void signal_reload(/*@unused@*/ int sig) -{ - (void)signal(SIGUSR1, signal_reload); - - (void)sig; - - if (AraKiri) - return; - -#ifdef USE_USB - HPReCheckSerialReaders(); -#endif -} /* signal_reload */ - static void signal_trap(int sig) { - Log2(PCSC_LOG_INFO, "Received signal: %d", sig); - - /* do not wait if asked to terminate - * avoids waiting after the reader(s) in shutdown for example */ - if (SIGTERM == sig) - { - Log1(PCSC_LOG_INFO, "Direct suicide"); - at_exit(); - } - - if (SIGALRM == sig) - { - /* normal exit without error */ - ExitValue = EXIT_SUCCESS; - } - - /* the signal handler is called several times for the same Ctrl-C */ - if (AraKiri == FALSE) - { - Log1(PCSC_LOG_INFO, "Preparing for suicide"); - AraKiri = TRUE; - - /* if still in the init/loading phase the AraKiri will not be - * seen by the main event loop - */ - if (Init) - { - Log1(PCSC_LOG_INFO, "Suicide during init"); - at_exit(); - } - } - else - { - /* if pcscd do not want to die */ - static int lives = 2; + int r; - lives--; - /* no live left. Something is blocking the normal death. */ - if (0 == lives) - { - Log1(PCSC_LOG_INFO, "Forced suicide"); - at_exit(); - } - } + r = write(signal_handler_fd[1], &sig, sizeof sig); + if (r < 0) + Log2(PCSC_LOG_ERROR, "write failed: %s", strerror(errno)); } static void print_version (void) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/src/readerfactory.c new/pcsc-lite-1.8.17/src/readerfactory.c --- old/pcsc-lite-1.8.16/src/readerfactory.c 2015-12-25 20:55:51.000000000 +0100 +++ new/pcsc-lite-1.8.17/src/readerfactory.c 2016-05-20 19:44:43.000000000 +0200 @@ -49,6 +49,7 @@ #include <errno.h> #include <fcntl.h> #include <pthread.h> +#include "alloca.h" #include "misc.h" #include "pcscd.h" @@ -1026,15 +1027,25 @@ rv = RFCheckSharing(hCard, rContext); if (SCARD_S_SUCCESS == rv) { - if (rContext->LockCount > 0) + if (PCSCLITE_SHARING_EXCLUSIVE_CONTEXT == rContext->contexts) { - rContext->LockCount -= 1; - if (0 == rContext->LockCount) - rContext->hLockId = 0; + if (rContext->LockCount > 1) + rContext->LockCount -= 1; + else + rv = SCARD_E_NOT_TRANSACTED; } else - /* rContext->LockCount == 0 */ - rv = SCARD_E_NOT_TRANSACTED; + { + if (rContext->LockCount > 0) + { + rContext->LockCount -= 1; + if (0 == rContext->LockCount) + rContext->hLockId = 0; + } + else + /* rContext->LockCount == 0 */ + rv = SCARD_E_NOT_TRANSACTED; + } } (void)pthread_mutex_unlock(&LockMutex); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/src/utils.c new/pcsc-lite-1.8.17/src/utils.c --- old/pcsc-lite-1.8.16/src/utils.c 2015-11-06 09:39:51.000000000 +0100 +++ new/pcsc-lite-1.8.17/src/utils.c 2016-05-06 13:16:10.000000000 +0200 @@ -94,11 +94,12 @@ if (pid != -1) { - Log2(PCSC_LOG_INFO, "Send hotplug signal to pcscd (pid=%d)", pid); + Log2(PCSC_LOG_INFO, "Send hotplug signal to pcscd (pid=%ld)", + (long)pid); if (kill(pid, SIGUSR1) < 0) { - Log3(PCSC_LOG_CRITICAL, "Can't signal pcscd (pid=%d): %s", - pid, strerror(errno)); + Log3(PCSC_LOG_CRITICAL, "Can't signal pcscd (pid=%ld): %s", + (long)pid, strerror(errno)); return EXIT_FAILURE ; } (void)SYS_Sleep(1); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/src/winscard.c new/pcsc-lite-1.8.17/src/winscard.c --- old/pcsc-lite-1.8.16/src/winscard.c 2016-03-12 20:03:09.000000000 +0100 +++ new/pcsc-lite-1.8.17/src/winscard.c 2016-05-20 19:44:43.000000000 +0200 @@ -1137,6 +1137,18 @@ if (rv != SCARD_S_SUCCESS) goto exit; + /* + * Error if another transaction is ongoing and a card action is + * requested + */ + if ((dwDisposition != SCARD_LEAVE_CARD) && (rContext->hLockId != 0) + && (rContext->hLockId != hCard)) + { + Log1(PCSC_LOG_INFO, "No card reset within a transaction"); + rv = SCARD_E_SHARING_VIOLATION; + goto exit; + } + if (dwDisposition == SCARD_RESET_CARD || dwDisposition == SCARD_UNPOWER_CARD) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/pcsc-lite-1.8.16/src/winscard_clnt.c new/pcsc-lite-1.8.17/src/winscard_clnt.c --- old/pcsc-lite-1.8.16/src/winscard_clnt.c 2016-03-12 20:03:09.000000000 +0100 +++ new/pcsc-lite-1.8.17/src/winscard_clnt.c 2016-05-29 14:14:24.000000000 +0200 @@ -794,6 +794,7 @@ if (NULL == currentContextMap) return SCARD_E_INVALID_HANDLE; + memset(scConnectStruct.szReader, 0, sizeof scConnectStruct.szReader); strncpy(scConnectStruct.szReader, szReader, sizeof scConnectStruct.szReader); scConnectStruct.szReader[sizeof scConnectStruct.szReader -1] = '\0'; @@ -1623,9 +1624,17 @@ * rgReaderStates[1].szReader = "\\\\?PnP?\\Notification"; * rgReaderStates[1].dwCurrentState = SCARD_STATE_UNAWARE; * ... + * // Get current state * rv = SCardGetStatusChange(hContext, INFINITE, rgReaderStates, 2); * printf("reader state: 0x%04X\n", rgReaderStates[0].dwEventState); * printf("reader state: 0x%04X\n", rgReaderStates[1].dwEventState); + * + * // Wait for card insertion + * if (rgReaderStates[0].dwEventState & SCARD_STATE_EMPTY) + * { + * rgReaderStates[0].dwCurrentState = rgReaderStates[0].dwEventState; + * rv = SCardGetStatusChange(hContext, INFINITE, rgReaderStates, 2); + * } * @endcode */ LONG SCardGetStatusChange(SCARDCONTEXT hContext, DWORD dwTimeout, @@ -2319,14 +2328,18 @@ * - \ref SCARD_ATTR_VENDOR_IFD_VERSION * - \ref SCARD_ATTR_VENDOR_NAME * @param[out] pbAttr Pointer to a buffer that receives the attribute. - * @param[in,out] pcbAttrLen Length of the \p pbAttr buffer in bytes. + * If this value is NULL, SCardGetAttrib() ignores the buffer length + * supplied in \p pcbAttrLen, writes the length of the buffer that would + * have been returned if this parameter had not been NULL to \p pcbAttrLen, + * and returns a success code. + * @param[in,out] pcbAttrLen Length of the \p pbAttr buffer in bytes and receives the actual length of the received attribute. * * @return Error code. * @retval SCARD_S_SUCCESS Successful (\ref SCARD_S_SUCCESS) * @retval SCARD_E_UNSUPPORTED_FEATURE the \p dwAttrId attribute is not supported by the driver (\ref SCARD_E_UNSUPPORTED_FEATURE) * @retval SCARD_E_NOT_TRANSACTED the driver returned an error (\ref SCARD_E_NOT_TRANSACTED) * @retval SCARD_E_INSUFFICIENT_BUFFER \p cbAttrLen is too big (\ref SCARD_E_INSUFFICIENT_BUFFER) - * @retval SCARD_E_INSUFFICIENT_BUFFER Reader buffer not large enough (\ref SCARD_E_INSUFFICIENT_BUFFER) + * @retval SCARD_E_INSUFFICIENT_BUFFER \p pbAttr buffer not large enough. In that case the expected buffer size is indicated in \p *pcbAttrLen (\ref SCARD_E_INSUFFICIENT_BUFFER) * @retval SCARD_E_INVALID_HANDLE Invalid \p hCard handle (\ref SCARD_E_INVALID_HANDLE) * @retval SCARD_E_INVALID_PARAMETER A parameter is NULL and should not (\ref SCARD_E_INVALID_PARAMETER) * @retval SCARD_E_NO_MEMORY Memory allocation failed (\ref SCARD_E_NO_MEMORY) @@ -2340,14 +2353,19 @@ * SCARDCONTEXT hContext; * SCARDHANDLE hCard; * DWORD dwActiveProtocol; - * unsigned char pbAtr[MAX_ATR_SIZE]; - * DWORD dwAtrLen; + * unsigned char *pbAttr; + * DWORD dwAttrLen; * ... * rv = SCardEstablishContext(SCARD_SCOPE_SYSTEM, NULL, NULL, &hContext); * rv = SCardConnect(hContext, "Reader X", SCARD_SHARE_SHARED, * SCARD_PROTOCOL_RAW, &hCard, &dwActiveProtocol); - * dwAtrLen = sizeof(pbAtr); - * rv = SCardGetAttrib(hCard, SCARD_ATTR_ATR_STRING, pbAtr, &dwAtrLen); + * rv = SCardGetAttrib(hCard, SCARD_ATTR_ATR_STRING, NULL, &dwAttrLen); + * if (SCARD_S_SUCCESS == rv) + * { + * pbAttr = malloc(dwAttrLen); + * rv = SCardGetAttrib(hCard, SCARD_ATTR_ATR_STRING, pbAttr, &dwAttrLen); + * free(pbAttr); + * } * @endcode * * @code @@ -2490,11 +2508,16 @@ scGetSetStruct.hCard = hCard; scGetSetStruct.dwAttrId = dwAttrId; - scGetSetStruct.cbAttrLen = *pcbAttrLen; scGetSetStruct.rv = SCARD_E_NO_SERVICE; memset(scGetSetStruct.pbAttr, 0, sizeof(scGetSetStruct.pbAttr)); if (SCARD_SET_ATTRIB == command) + { memcpy(scGetSetStruct.pbAttr, pbAttr, *pcbAttrLen); + scGetSetStruct.cbAttrLen = *pcbAttrLen; + } + else + /* we can get up to the communication buffer size */ + scGetSetStruct.cbAttrLen = sizeof scGetSetStruct.pbAttr; rv = MessageSendWithHeader(command, currentContextMap->dwClientID, sizeof(scGetSetStruct), &scGetSetStruct); @@ -2518,7 +2541,12 @@ */ if (*pcbAttrLen < scGetSetStruct.cbAttrLen) { + /* restrict the value of scGetSetStruct.cbAttrLen to avoid a + * buffer overflow in the memcpy() bellow */ + DWORD correct_value = scGetSetStruct.cbAttrLen; scGetSetStruct.cbAttrLen = *pcbAttrLen; + *pcbAttrLen = correct_value; + scGetSetStruct.rv = SCARD_E_INSUFFICIENT_BUFFER; } else

1 0

commit pacemaker for openSUSE:Factory
by root＠hilbert.suse.de 02 Jun '16

02 Jun '16

Hello community, here is the log from the commit of package pacemaker for openSUSE:Factory checked in at 2016-06-02 12:38:57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/pacemaker (Old) and /work/SRC/openSUSE:Factory/.pacemaker.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "pacemaker" Changes: -------- --- /work/SRC/openSUSE:Factory/pacemaker/pacemaker.changes 2016-04-07 13:27:54.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.pacemaker.new/pacemaker.changes 2016-06-02 12:38:59.000000000 +0200 @@ -1,0 +2,56 @@ +Sun May 29 20:06:12 UTC 2016 - ygao(a)suse.com + +- controld: Prevent unwanted self-fencing if "stateful_merge_wait" state of dlm is not available (bsc#977201) + * bug-977201_pacemaker-controld-self-fencing.patch + +------------------------------------------------------------------- +Sun May 29 14:44:18 UTC 2016 - ygao(a)suse.com + +- libservices: clean up non-signalfd code paths +- spec: fence_pcmk only eligible for Pacemaker+CMAN +- crmd: Acknowledge cancellation operations for remote connection resources (bsc#976865) +- controld: improve DLM check with stateful_merge_wait (bsc#977201) +- attrd, libcrmcommon: validate attrd requests better +- crmd: clear remote node transient attributes on disconnect +- Revert "Fix: attrd: Correctly implement mass removal of a node's attributes" +- crm_mon: Fix time formatting on x32 +- resources: use OCF version tagging correctly +- libcommon: crm_procfs_pid_of() would always return last /proc entry checked +- crmd: correctly dig into cib-query-answer if alerts section is present timestamp-format defaults to "%H:%M:%S.%06N" +- crmd: Take start-delay into account for the timeout of the action timer (bsc#977258) +- libservices: make systemd override file world-readable to avoid log warning +- libcrmcommon: correct directory name in log message +- Log: make crmd messages more user-friendly +- Log: make messages in common quorum/fencing situations more user-friendly +- Log: make shutdown messages more user-friendly +- pengine: lf#2560/lf#2588 - Correctly set the environment variable "OCF_RESKEY_CRM_meta_timeout" when "start-delay" is configured (bsc#977258) +- Log: make operation messages more user-friendly +- Log: make startup messages more user-friendly +- services: Correctly clean up service actions for non-dbus case +- uninitialized use of nano_digits +- attrd: Update also dampens when synchronizing attributes (bsc#977846) +- Upstream version cs: 389294fd1ebefddad67fff51306f585b758ca860 + +------------------------------------------------------------------- +Wed May 4 10:38:16 UTC 2016 - ygao(a)suse.com + +- Rebase: + * pacemaker-Wno-format-signedness.patch + +- RA: SysInfo - Reset the node attribute "#health_disk" to "green" when there's sufficient free disk (bsc#975079) +- pengine: Organize order of actions for slave resources in anti-colocations (bsc#977800) +- attrd: Fix the synchronization of attributes (bsc#977846) +- pengine: Organize order of actions for master resources in anti-colocations (bsc#977800) +- pengine: Respect asymmetrical ordering when trying to move resources (bsc#977675) +- fencing: Record the last known names of nodes to make sure fencing requested with nodeid works (bsc#974108) +- crmd: first implementation of integrated multi-agent, multi-target alerting mechanism +- ping resource: Use fping6 for IPv6 hosts (bsc#976271) +- pengine: Consider resource failed if any of the configured monitor operations failed (bsc#972187) +- ping resource: avoid undefined func w/ OCF_FUNCTIONS=/dev/null +- spec: make Publican docs not depend on pre-existing packages +- cib/fencing: Set status callback before connecting to cluster (bsc#974108) +- xml: use spaces instead of tabs in schema files +- extra: Support of the dampen change by RA. +- Upstream version cs: 9e382568ac3cd54c222496501088ab3fc158b2e2 + +------------------------------------------------------------------- Old: ---- pacemaker-1.1.14+git20160324.5a6cdd1.tar.bz2 New: ---- bug-977201_pacemaker-controld-self-fencing.patch pacemaker-1.1.14+git20160527.389294f.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ pacemaker.spec ++++++ --- /var/tmp/diff_new_pack.fAOtQV/_old 2016-06-02 12:39:00.000000000 +0200 +++ /var/tmp/diff_new_pack.fAOtQV/_new 2016-06-02 12:39:00.000000000 +0200 @@ -21,23 +21,42 @@ %global pcmk_docdir %{_docdir}/%{name} %global specversion 1 +%global pcmkversion 1.1.14+git20160527.389294f +# set following to the actual commit or, for final release, concatenate +# "pcmkversion" macro to "Pacemaker-" (will yield a tag per the convention) %global commit HEAD -%global shortcommit %(c=%{commit}; echo ${c:0:7}) +%global lparen ( +%global rparen ) +%global shortcommit %(c=%{commit}; case ${c} in + Pacemaker-*%{rparen} echo ${c:10};; + *%{rparen} echo ${c:0:7};; esac) +%global pre_release %(s=%{shortcommit}; [ ${s: -4:3} != -rc ]; echo $?) +%global post_release %([ %{commit} = Pacemaker-%{shortcommit} ]; echo $?) %global github_owner ClusterLabs # Turn off the auto compilation of python files not in the site-packages directory # Needed so that the -devel package is multilib compliant %global __os_install_post %(echo '%{__os_install_post}' | sed -e 's!/usr/lib[^[:space:]]*/brp-python-bytecompile[[:space:]].*$!!g') -#%%global rawhide %%(test ! -e /etc/yum.repos.d/fedora-rawhide.repo; echo $?) +#%global rawhide %(test ! -e /etc/yum.repos.d/fedora-rawhide.repo; echo $?) %global rawhide 0 #%%global cs_version %%(pkg-config corosync --modversion | awk -F . '{print $1}') %global cs_version 2 # It has to be eventually decided whether to use Python2 or Python3 %global py_site %{?python_sitearch}%{!?python_sitearch:%(python -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")} +%global cman_native 0%{?el6} || (0%{?fedora} > 0 && 0%{?fedora} < 17) -# https://fedoraproject.org/wiki/EPEL:Packaging?rd=Packaging:EPEL#The_.25lice… -%{!?_licensedir:%global license %doc} +# It's desired to apply "license" macro uniformly in "files" sections below, +# but RPM versions not aware of this new classification normally (re)define it +# to the value of "License:", so following is to ensure the macro definition +# is per expectation only after that tag; solution courtesy of Jason Tibbitts: +# https://pkgs.fedoraproject.org/cgit/rpms/epel-rpm-macros.git/tree/macros.zz… +%if !%{defined _licensedir} +%define description %{lua: + rpm.define("license %doc") + print("%description") +} +%endif # Conditionals # Invoke "rpmbuild --without <feature>" or "rpmbuild --with <feature>" @@ -72,11 +91,19 @@ %global debug_package %{nil} %endif -%if %{with pre_release} +%if %{with pre_release} || 0%{pre_release} +%if 0%{pre_release} +%global pcmk_release 0.%{specversion}.%(s=%{shortcommit}; echo ${s: -3}) +%else %global pcmk_release 0.%{specversion}.%{shortcommit}.git +%endif +%else +%if 0%{post_release} +%global pcmk_release %{specversion}.%{shortcommit}.git %else %global pcmk_release %{specversion} %endif +%endif #%if 0%{?suse_version} #%define _libexecdir %{_libdir} @@ -110,12 +137,12 @@ %endif # AGPL-3.0 licensed extra/clustermon.sh is not present in the binary Group: Productivity/Clustering/HA -Version: 1.1.14+git20160324.5a6cdd1 +Version: %{pcmkversion} Release: 0 #Release: %{pcmk_release}%{?dist} Url: http://www.clusterlabs.org -#Source0: https://github.com/%{github_owner}/%{name}/archive/%{commit}/%{name}-%{comm… +#Source0: https://github.com/%{github_owner}/%{name}/archive/%{commit}/%{name}-%{shor… Source0: %{name}-%{version}.tar.bz2 Source1: crm_report.in Source100: pacemaker.rpmlintrc @@ -127,6 +154,7 @@ Patch6: bug-812269_pacemaker-fencing-device-register-messages.patch Patch7: pacemaker-Wno-format-signedness.patch Patch8: bug-943295_pacemaker-lrmd-log-notice.patch +Patch9: bug-977201_pacemaker-controld-self-fencing.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build Provides: pacemaker-ticket-support = 2.0 Conflicts: heartbeat < 3.0 @@ -207,20 +235,11 @@ BuildRequires: pkgconfig(systemd) -%if %{with cman} - -%if 0%{?fedora} > 0 -%if 0%{?fedora} < 17 -BuildRequires: clusterlib-devel -%endif -%endif - -%if 0%{?rhel} > 0 -%if 0%{?rhel} < 7 +%if %{with cman} && %{cman_native} BuildRequires: clusterlib-devel -%endif -%endif - +# pacemaker initscript: cman initscript, fence_tool (+ some soft-dependencies) +# "post" scriptlet: ccs_update_schema +Requires: cman %endif %if %with_corosync_support @@ -421,6 +440,7 @@ %patch6 -p1 %patch7 -p1 %patch8 -p1 +%patch9 -p1 # Force the local time # @@ -459,6 +479,7 @@ %if !%enable_fatal_warnings --enable-fatal-warnings=no \ %endif + %{!?with_doc: --with-brand=} \ --with-initdir=%{_initrddir} \ --localstatedir=%{_var} \ --with-version=%{version}-%{release} @@ -510,6 +531,11 @@ rm -f %{buildroot}/%{_initrddir}/pacemaker rm -f %{buildroot}/%{_initrddir}/pacemaker_remote +# Don't ship fence_pcmk where it has no use +%if %{without cman} +rm -f %{buildroot}/%{_sbindir}/fence_pcmk +%endif + ln -s /usr/sbin/service %{buildroot}%{_sbindir}/rcpacemaker ln -s /usr/sbin/service %{buildroot}%{_sbindir}/rcpacemaker_remote ln -s /usr/sbin/service %{buildroot}%{_sbindir}/rccrm_mon @@ -588,6 +614,12 @@ %post /sbin/chkconfig --add pacemaker || : +%if %{with cman} && %{cman_native} +# make fence_pcmk in cluster.conf valid instantly otherwise tools like ccs may +# choke (until schema gets auto-regenerated on the next start of cluster), +# per the protocol shared with other packages contributing to cluster.rng +/usr/sbin/ccs_update_schema >/dev/null 2>&1 || : +%endif %preun /sbin/service pacemaker stop || : @@ -669,17 +701,23 @@ %{_sbindir}/crm_node %{_sbindir}/fence_legacy +%if %{with cman} %{_sbindir}/fence_pcmk +%endif %{_sbindir}/stonith_admin %doc %{_mandir}/man7/crmd.* %doc %{_mandir}/man7/pengine.* %doc %{_mandir}/man7/stonithd.* +%if %{without cman} || !%{cman_native} %doc %{_mandir}/man7/ocf_pacemaker_controld.* +%endif %doc %{_mandir}/man7/ocf_pacemaker_o2cb.* %doc %{_mandir}/man7/ocf_pacemaker_remote.* %doc %{_mandir}/man8/crm_node.* +%if %{with cman} %doc %{_mandir}/man8/fence_pcmk.* +%endif %doc %{_mandir}/man8/fence_legacy.* %doc %{_mandir}/man8/pacemakerd.* %doc %{_mandir}/man8/stonith_admin.* @@ -691,7 +729,9 @@ %dir %attr (750, %{uname}, %{gname}) %{_var}/lib/pacemaker/cib %dir %attr (750, %{uname}, %{gname}) %{_var}/lib/pacemaker/pengine +%if %{without cman} || !%{cman_native} /usr/lib/ocf/resource.d/pacemaker/controld +%endif /usr/lib/ocf/resource.d/pacemaker/o2cb /usr/lib/ocf/resource.d/pacemaker/remote /usr/lib/ocf/resource.d/.isolation ++++++ _service ++++++ --- /var/tmp/diff_new_pack.fAOtQV/_old 2016-06-02 12:39:00.000000000 +0200 +++ /var/tmp/diff_new_pack.fAOtQV/_new 2016-06-02 12:39:00.000000000 +0200 @@ -11,7 +11,7 @@ <param name="version">1.1.14</param> --> <param name="versionformat">1.1.14+git%cd.%h</param> - <param name="revision">5a6cdd11b4f93b4d55e1b2654078018c339931d4</param> + <param name="revision">389294fd1ebefddad67fff51306f585b758ca860</param> </service> <service name="recompress" mode="disabled"> ++++++ bug-977201_pacemaker-controld-self-fencing.patch ++++++ commit f61b9889cd169ce2c715a5cc4808321977432ec0 Author: Gao,Yan <ygao(a)suse.com> Date: Sun May 29 20:31:25 2016 +0200 Fix: controld: Prevent unwanted self-fencing if "stateful_merge_wait" state of dlm is not available diff --git a/extra/resources/controld b/extra/resources/controld index 7d75319..908e2ca 100644 --- a/extra/resources/controld +++ b/extra/resources/controld @@ -229,13 +229,9 @@ controld_monitor() { case $rc in 0) smw=$(dlm_tool status -v | grep "stateful_merge_wait=" | cut -d= -f2) - if [ $smw -eq 1 ]; then + if [ "$smw" = "1" ]; then ocf_log err "DLM status is: stateful_merge_wait" rc=$OCF_ERR_GENERIC - elif [ -z "$smw" ] && dlm_tool ls | grep -q "wait fencing" && \ - ! stonith_admin -H -V | grep -q "wishes to"; then - ocf_log err "DLM status is: wait fencing" - rc=$OCF_ERR_GENERIC else rc=$OCF_SUCCESS fi ++++++ pacemaker-1.1.14+git20160324.5a6cdd1.tar.bz2 -> pacemaker-1.1.14+git20160527.389294f.tar.bz2 ++++++ ++++ 32074 lines of diff (skipped) ++++++ pacemaker-Wno-format-signedness.patch ++++++ --- /var/tmp/diff_new_pack.fAOtQV/_old 2016-06-02 12:39:04.000000000 +0200 +++ /var/tmp/diff_new_pack.fAOtQV/_new 2016-06-02 12:39:04.000000000 +0200 @@ -1,13 +1,19 @@ -Index: pacemaker-1.1.12.git20150129.3021d73/configure.ac +Index: pacemaker-1.1.14+git20160503.9e38256/configure.ac =================================================================== ---- pacemaker-1.1.12.git20150129.3021d73.orig/configure.ac 2015-02-24 13:22:11.748602751 +0100 -+++ pacemaker-1.1.12.git20150129.3021d73/configure.ac 2015-02-24 13:22:29.684800783 +0100 -@@ -1708,7 +1708,7 @@ else - -Wdeclaration-after-statement - -Wendif-labels - -Wfloat-equal -- -Wformat=2 -+ -Wformat=2 -Wno-format-signedness - -Wformat-security - -Wformat-nonliteral - -Wmissing-prototypes +--- pacemaker-1.1.14+git20160503.9e38256.orig/configure.ac ++++ pacemaker-1.1.14+git20160503.9e38256/configure.ac +@@ -1792,12 +1792,12 @@ dnl otherwise none of both + AC_DEFINE([GCC_FORMAT_NONLITERAL_CHECKING_ENABLED], [], + [gcc can complain about nonliterals in format]) + EXTRA_FLAGS="$EXTRA_FLAGS +- -Wformat=2 ++ -Wformat=2 -Wno-format-signedness + -Wformat-nonliteral" + else + if test "x$gcc_format_nonliteral" = "xyes"; then + EXTRA_FLAGS="$EXTRA_FLAGS +- -Wformat=2" ++ -Wformat=2 -Wno-format-signedness" + fi + fi +

1 0

commit bluez for openSUSE:Factory
by root＠hilbert.suse.de 02 Jun '16

02 Jun '16

Hello community, here is the log from the commit of package bluez for openSUSE:Factory checked in at 2016-06-02 12:38:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/bluez (Old) and /work/SRC/openSUSE:Factory/.bluez.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "bluez" Changes: -------- --- /work/SRC/openSUSE:Factory/bluez/bluez.changes 2016-04-14 13:01:32.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.bluez.new/bluez.changes 2016-06-02 12:38:53.000000000 +0200 @@ -1,0 +2,17 @@ +Sat May 28 07:33:16 UTC 2016 - seife+obs(a)b1-systems.com + +- update to version 5.40: + This is mostly a bug fix release fixing issues with GATT, paired + devices and connection handling (particularly for accepting + connections through the Profile D-Bus interface). + One new feature is the ability to use btmon for reading HCI logs + from a TTY device. Right now the creation of this kind of logs is + available with Zephyr <https://www.zephyrproject.org/> in the + form of a special console logging mode (more information + available here + https://www.zephyrproject.org/doc/board/arduino_101_ble.html#getting-hci-tr…>). + The format of the protocol is a slight modification of what btmon + normally receives from the kernel monitor sockets, and is + documented in doc/btsnoop.txt). + +------------------------------------------------------------------- Old: ---- bluez-5.39.tar.xz New: ---- bluez-5.40.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ bluez.spec ++++++ --- /var/tmp/diff_new_pack.XyMGZB/_old 2016-06-02 12:38:54.000000000 +0200 +++ /var/tmp/diff_new_pack.XyMGZB/_new 2016-06-02 12:38:54.000000000 +0200 @@ -2,7 +2,7 @@ # spec file for package bluez # # Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany. -# Copyright (c) 2010-2014 B1 Systems GmbH, Vohburg, Germany +# Copyright (c) 2010-2016 B1 Systems GmbH, Vohburg, Germany # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -24,7 +24,7 @@ BuildRequires: systemd-devel BuildRequires: pkgconfig(dbus-1) >= 1.6 %{?systemd_requires} -Version: 5.39 +Version: 5.40 Release: 0 Summary: Bluetooth Stack for Linux License: GPL-2.0+ ++++++ bluez-5.39.tar.xz -> bluez-5.40.tar.xz ++++++ ++++ 5011 lines of diff (skipped)

1 0

commit postfix for openSUSE:Factory
by root＠hilbert.suse.de 02 Jun '16

02 Jun '16

Hello community, here is the log from the commit of package postfix for openSUSE:Factory checked in at 2016-06-02 12:38:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/postfix (Old) and /work/SRC/openSUSE:Factory/.postfix.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "postfix" Changes: -------- --- /work/SRC/openSUSE:Factory/postfix/postfix.changes 2015-12-17 15:53:28.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.postfix.new/postfix.changes 2016-06-02 12:38:47.000000000 +0200 @@ -1,0 +2,265 @@ +Sun May 29 16:45:30 UTC 2016 - chris(a)computersalat.de + +- fix Changelog cause of Factory decline + +------------------------------------------------------------------- +Tue May 24 13:18:55 UTC 2016 - varkoly(a)suse.com + +- Fix typo in config.postfix + +------------------------------------------------------------------- +Tue May 24 04:29:41 UTC 2016 - varkoly(a)suse.com + +- bnc#981097 config.postfix creates broken main.cf for tls client configuration +- bnc#981099 /etc/sysconfig/postfix: POSTFIX_SMTP_TLS_CLIENT incomplete +- update to 3.1.1: +- The new address_verify_pending_request_limit + parameter introduces a safety limit for the number of address + verification probes in the active queue. The default limit is 1/4 + of the active queue maximum size. The queue manager enforces the + limit by tempfailing probe messages that exceed the limit. This + design avoids dependencies on global counters that get out of sync + after a process or system crash. +- Machine-readable, JSON-formatted queue listing with "postqueue -j" + (no "mailq" equivalent). +- The milter_macro_defaults feature provides an optional list of macro + name=value pairs. These specify default values for Milter macros when + no value is available from the SMTP session context. +- Support to enforce a destination-independent delay between email + deliveries. The following example inserts 20 seconds of delay + between all deliveries with the SMTP transport, limiting the delivery + rate to at most three messages per minute. + smtp_transport_rate_delay = 20s +- Historically, the default setting "postscreen_dnsbl_ttl = 1h" assumes + that a "not found" result from a DNSBL server will be valid for one + hour. This may have been adequate five years ago when postscreen + was first implemented, but nowadays, that one hour can result in + missed opportunities to block new spambots. + To address this, postscreen now respects the TTL of DNSBL "not + found" replies, as well as the TTL of DNSWL replies (both "found" + and "not found"). The TTL for a "not found" reply is determined + according to RFC 2308 (the TTL of an SOA record in the reply). + + Support for DNSBL or DNSWL reply TTL values is controlled by two + configuration parameters: + + postscreen_dnsbl_min_ttl (default: 60 seconds). + postscreen_dnsbl_max_ttl (default: $postscreen_dnsbl_ttl or 1 hour) + + The postscreen_dnsbl_ttl parameter is now obsolete, and has become + the default value for the new postscreen_dnsbl_max_ttl parameter. +- New "smtpd_client_auth_rate_limit" feature, to + enforce an optional rate limit on AUTH commands per SMTP client IP + address. Similar to other smtpd_client_*_rate_limit features, this + enforces a limit on the number of requests per $anvil_rate_time_unit. +- New SMTPD policy service attribute "policy_context", + with a corresponding "smtpd_policy_service_policy_context" configuration + parameter. Originally, this was implemented to share the same SMTPD + policy service endpoint among multiple check_policy_service clients. +- A new "postfix tls" command to quickly enable opportunistic TLS + in the Postfix SMTP client or server, and to manage SMTP server keys + and certificates, including certificate signing requests and + TLSA DNS records for DANE. + +------------------------------------------------------------------- +Tue Apr 19 07:59:32 UTC 2016 - opensuse(a)dstoecker.de + +- build with working support for SMTPUTF8 + +------------------------------------------------------------------- +Sun Mar 20 14:11:27 UTC 2016 - mrueckert(a)suse.de + +- fix build on sle11 by pointing _libexecdir to /usr/lib all the + time. + +------------------------------------------------------------------- +Sun Mar 20 13:46:56 UTC 2016 - mrueckert(a)suse.de + +- some distros did not pull pkgconfig indirectly. pull it directly. + +------------------------------------------------------------------- +Sun Mar 20 08:19:23 UTC 2016 - mrueckert(a)suse.de + +- fix building the dynamic maps: the old build had postgresql e.g. + with missing symbols. + - convert to AUXLIBS_* instead of plain AUXLIBS which is needed + for proper dynamic maps. + - reordered the CCARGS and AUXLIBS* lines to group by feature + - use pkgconfig or *_config tools where possible +- picked up signed char from fedora spec file +- enable lmdb support: new BR lmdb-devel, new subpackage + postfix-lmdb. +- don't delete vmail user/groups + +------------------------------------------------------------------- +Wed Mar 9 13:06:35 UTC 2016 - varkoly(a)suse.com + +- update to 3.1.0 +- Since version 3.0 postfix supports dynamic loading of cdb:, ldap:, + lmdb:, mysql:, pcre:, pgsql:, sdbm:, and sqlite: database clients. + Thats why the patches dynamic_maps.patch and dynamic_maps_pie.patch + could be removed. +- Adapting all the patches to postfix 3.1.0 +- remove obsolete patches + * add_missed_library.patch + * postfix-opensslconfig.patch +- update vda patch + * remove postfix-vda-v13-2.10.0.patch + * add postfix-vda-v13-3.10.0.patch +- The patch postfix-db6.diff is not more neccessary + +- Backwards-compatibility safety net. + With NEW Postfix installs, you MUST install a main.cf file with + the setting "compatibility_level = 2". See conf/main.cf for an + example. + + With UPGRADES of existing Postfix systems, you MUST NOT change the + main.cf compatibility_level setting, nor add this setting if it + does not exist. + + Several Postfix default settings have changed with Postfix 3.0. To + avoid massive frustration with existing Postfix installations, + Postfix 3.0 comes with a safety net that forces Postfix to keep + running with backwards-compatible main.cf and master.cf default + settings. This safety net depends on the main.cf compatibility_level + setting (default: 0). Details are in COMPATIBILITY_README. + +- Major changes - tls +* [Feature 20160207] A new "postfix tls" command to quickly enable + opportunistic TLS in the Postfix SMTP client or server, and to + manage SMTP server keys and certificates, including certificate + signing requests and TLSA DNS records for DANE. +* As of the middle of 2015, all supported Postfix releases no longer + nable "export" grade ciphers for opportunistic TLS, and no longer + use the deprecated SSLv2 and SSLv3 protocols for mandatory or + opportunistic TLS. +* [Incompat 20150719] The default Diffie-Hellman non-export prime was + updated from 1024 to 2048 bits, because SMTP clients are starting + to reject TLS handshakes with primes smaller than 2048 bits. +* [Feature 20160103] The Postfix SMTP client by default enables DANE + policies when an MX host has a (DNSSEC) secure TLSA DNS record, + even if the MX DNS record was obtained with insecure lookups. The + existence of a secure TLSA record implies that the host wants to + talk TLS and not plaintext. For details see the + smtp_tls_dane_insecure_mx_policy configuration parameter. + +- Major changes - default settings + [Incompat 20141009] The default settings have changed for relay_domains + (new: empty, old: $mydestination) and mynetworks_style (new: host, + old: subnet). However the backwards-compatibility safety net will + prevent these changes from taking effect, giving the system + administrator the option to make an old default setting permanent + in main.cf or to adopt the new default setting, before turning off + backwards compatibility. See COMPATIBILITY_README for details. + + [Incompat 20141001] A new backwards-compatibility safety net forces + Postfix to run with backwards-compatible main.cf and master.cf + default settings after an upgrade to a newer but incompatible Postfix + version. See COMPATIBILITY_README for details. + + While the backwards-compatible default settings are in effect, + Postfix logs what services or what email would be affected by the + incompatible change. Based on this the administrator can make some + backwards-compatibility settings permanent in main.cf or master.cf, + before turning off backwards compatibility. + +- Major changes - address verification safety + [Feature 20151227] The new address_verify_pending_request_limit + parameter introduces a safety limit for the number of address + verification probes in the active queue. The default limit is 1/4 + of the active queue maximum size. The queue manager enforces the + limit by tempfailing probe messages that exceed the limit. This + design avoids dependencies on global counters that get out of sync + after a process or system crash. + + Tempfailing verify requests is not as bad as one might think. The + Postfix verify cache proactively updates active addresses weeks + before they expire. The address_verify_pending_request_limit affects + only unknown addresses, and inactive addresses that have expired + from the address verify cache (by default, after 31 days). + +- Major changes - json support + [Feature 20151129] Machine-readable, JSON-formatted queue listing + with "postqueue -j" (no "mailq" equivalent). The output is a stream + of JSON objects, one per queue file. To simplify parsing, each + JSON object is formatted as one text line followed by one newline + character. See the postqueue(1) manpage for a detailed description + of the output format. + +- Major changes - milter support + [Feature 20150523] The milter_macro_defaults feature provides an + optional list of macro name=value pairs. These specify default + values for Milter macros when no value is available from the SMTP + session context. + + For example, with "milter_macro_defaults = auth_type=TLS", the + Postfix SMTP server will send an auth_type of "TLS" to a Milter, + unless the remote client authenticates with SASL. ++++ 68 more lines (skipped) ++++ between /work/SRC/openSUSE:Factory/postfix/postfix.changes ++++ and /work/SRC/openSUSE:Factory/.postfix.new/postfix.changes Old: ---- add_missed_library.patch dynamic_maps.patch dynamic_maps_pie.patch postfix-2.11.7.tar.gz postfix-db6.diff postfix-opensslconfig.patch postfix-vda-v13-2.10.0.patch New: ---- postfix-3.1.1.tar.gz postfix-vda-v13-3.10.0.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ postfix.spec ++++++ --- /var/tmp/diff_new_pack.m0Tlbu/_old 2016-06-02 12:38:49.000000000 +0200 +++ /var/tmp/diff_new_pack.m0Tlbu/_new 2016-06-02 12:38:49.000000000 +0200 @@ -1,7 +1,7 @@ # # spec file for package postfix # -# Copyright (c) 2015 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -16,12 +16,19 @@ # +%if 0%{?suse_version} >= 1320 || ( 0%{?suse_version} == 1315 && 0%{?is_opensuse} ) +%bcond_without lmdb +%else +%bcond_with lmdb +%endif + # # Some defines # %define pf_docdir %{_docdir}/%{name}-doc %define pf_config_directory %{_sysconfdir}/%{name} %define pf_daemon_directory /usr/lib/%{name} +%define _libexecdir /usr/lib %define pf_command_directory %{_prefix}/sbin %define pf_queue_directory var/spool/%{name} %define pf_sendmail_path %{_sbindir}/sendmail @@ -52,39 +59,38 @@ %define _unitdir /lib/systemd %endif Name: postfix -Version: 2.11.7 +Version: 3.1.1 Release: 0 Summary: A fast, secure, and flexible mailer License: IPL-1.0 Group: Productivity/Networking/Email/Servers Url: http://www.postfix.org/ -Source: http://www.artfiles.org/postfix.org/postfix-release/official/postfix-%{vers… -#Source1: postfix-%{version}.tar.gz.asc +#Source: http://www.artfiles.org/postfix.org/postfix-release/official/postfix-%{vers… +Source: postfix-%{version}.tar.gz Source2: %{name}-SuSE.tar.gz Source3: %{name}-mysql.tar.bz2 -#Source4: %{name}.keyring -Source10: postfix-rpmlintrc +Source10: %{name}-rpmlintrc Source11: check_mail_queue -Patch0: dynamic_maps.patch -Patch1: dynamic_maps_pie.patch +Patch1: %{name}-no-md5.patch Patch2: pointer_to_literals.patch Patch3: ipv6_disabled.patch -Patch10: %{name}-main.cf.patch -Patch11: %{name}-master.cf.patch -Patch12: %{name}-post-install.patch -Patch20: %{name}-ssl-release-buffers.patch -Patch21: postfix-opensslconfig.patch -Patch100: %{name}-vda-v13-2.10.0.patch -Patch101: postfix-db6.diff -#PATCH-FIX-SLE PATCH-FIX-OPENSUSE to be able to build the agent tls_proxy -Patch102: add_missed_library.patch -Patch103: postfix-no-md5.patch +Patch4: %{name}-main.cf.patch +Patch5: %{name}-master.cf.patch +Patch6: %{name}-post-install.patch +Patch7: %{name}-ssl-release-buffers.patch +Patch8: %{name}-vda-v13-3.10.0.patch + BuildRequires: cyrus-sasl-devel BuildRequires: db-devel BuildRequires: libopenssl-devel +%if %{with lmdb} +BuildRequires: lmdb-devel +%endif +BuildRequires: libicu-devel BuildRequires: mysql-devel BuildRequires: openldap2-devel BuildRequires: pcre-devel +BuildRequires: pkgconfig BuildRequires: postgresql-devel Requires: iproute2 Requires(pre): permissions @@ -158,42 +164,82 @@ by starting %{name} if you'll access a postmap which is stored in PostgreSQL. +%if %{with lmdb} +%package lmdb +Summary: Postfix plugin to support LMDB maps +Group: Productivity/Networking/Email/Servers +Requires(pre): %{name} = %{version} + +%description lmdb +Postfix plugin to support LMDB maps. This library will be loaded +by starting %{name} if you'll access a postmap which is stored in +PostgreSQL. +%endif + %prep %setup -q -a 2 -a 3 -%patch0 -p1 %patch1 -p1 %patch2 -p1 %patch3 -%patch10 -%patch11 -%patch12 -%patch20 -%patch21 -%patch100 -p1 -%patch101 -%patch102 -%patch103 -p1 +%patch4 +%patch5 +%patch6 +%patch7 +%patch8 -p1 + # --------------------------------------------------------------------------- %build -export CCARGS="-DHAS_LDAP -DHAS_PCRE -DUSE_SASL_AUTH -I%{_includedir}/sasl" -export CCARGS="$CCARGS -DMAX_DYNAMIC_MAPS" -export CCARGS="$CCARGS -DHAS_MYSQL -I%{_includedir}/mysql" -export CCARGS="$CCARGS -DHAS_PGSQL -I%{_includedir}/pgsql" -export CCARGS="$CCARGS -DUSE_CYRUS_SASL" -export AUXLIBS="-lldap -llber -lpcre" -export AUXLIBS="$AUXLIBS -lsasl2" -export AUXLIBS="$AUXLIBS -lssl -lcrypto" -export CCARGS="$CCARGS -DUSE_TLS" -export CCARGS="$CCARGS %{optflags} -Wno-comments" +unset AUXLIBS AUXLIBS_LDAP AUXLIBS_PCRE AUXLIBS_MYSQL AUXLIBS_PGSQL AUXLIBS_SQLITE AUXLIBS_CDB + +export CCARGS="${CCARGS} %{optflags} -Wno-comments -Wno-missing-braces -fPIC" +%ifarch s390 s390x ppc +export CCARGS="${CCARGS} -fsigned-char" +%endif +# +if pkg-config openssl ; then + export CCARGS="${CCARGS} -DUSE_TLS $(pkg-config --cflags openssl)" + export AUXLIBS="$AUXLIBS $(pkg-config --libs openssl)" +else + export CCARGS="${CCARGS} -DUSE_TLS" + export AUXLIBS="${AUXLIBS} -lssl -lcrypto" +fi +# +export CCARGS="${CCARGS} -DHAS_LDAP -DLDAP_DEPRECATED=1 -DUSE_LDAP_SASL" +export AUXLIBS_LDAP="-lldap -llber" +# +export CCARGS="${CCARGS} -DHAS_PCRE" +export AUXLIBS_PCRE="-lpcre" +# +export CCARGS="${CCARGS} -DUSE_SASL_AUTH -DUSE_CYRUS_SASL -I%{_includedir}/sasl" +if pkg-config libsasl2 ; then + export AUXLIBS="$AUXLIBS $(pkg-config --libs libsasl2)" +else + export AUXLIBS="$AUXLIBS -lsasl2" +fi +# +export CCARGS="${CCARGS} -DHAS_MYSQL $(mysql_config --cflags)" +export AUXLIBS_MYSQL="$(mysql_config --libs)" +# +export CCARGS="${CCARGS} -DHAS_PGSQL -I$(pg_config --includedir)" +export AUXLIBS_PGSQL="-lpq" +# +%if %{with lmdb} +export CCARGS="${CCARGS} -DHAS_LMDB -I/usr/local/include" \ +export AUXLIBS_LMDB="-llmdb" +%endif +# +# TODO +#export AUXLIBS_SQLITE +#export AUXLIBS_CDB +#export AUXLIBS_SDBM + export PIE=-pie -make makefiles DEBUG="" -cd lib -for i in dns global master tls util milter; do - ln -sf lib${i}.a lib%{name}-${i}.so.1.0.1; -done -cd - -make LD_LIBRARY_PATH=$(pwd)/lib:${LD_LIBRARY_PATH} +make makefiles pie=yes shared=yes dynamicmaps=yes \ + shlib_directory=/usr/lib/postfix \ + meta_directory=/usr/lib/postfix \ + config_directory=/etc/postfix +make # --------------------------------------------------------------------------- %install @@ -202,16 +248,9 @@ useradd -r -o -g %{name} -u %{pf_uid} -s /bin/false -c "Postfix Daemon" -d /%{pf_queue_directory} %{name} 2> /dev/null || : usermod -G %{maildrop_gid},%{mail_gid} %{name} 2> /dev/null || : mkdir -p %{buildroot}/%{_libdir} -install lib/*.1 %{buildroot}/%{_libdir} -for i in %{buildroot}/%{_libdir}/*.1; do - ln -sf ${i##*/} ${i%.*.*} -done -cd lib -for i in libpostfix-*; do - ln -sf $i %{buildroot}/%{_libdir}/${i%%so.*}so -done -cd - -ln -sf $(pwd)/lib/dict_* libexec/ +mkdir -p %{buildroot}/etc/postfix +cp conf/* %{buildroot}/etc/postfix/ +cp lib/libpostfix-* %{buildroot}/%{_libdir} export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:%{buildroot}/%{_libdir} sh postfix-install -non-interactive \ install_root=%{buildroot} \ @@ -395,9 +434,6 @@ else echo "Can not find \"$FILE\". Not updating the file." >&2 fi - echo "Removing %{vmusr} user" - userdel %{vmusr} 2> /dev/null - groupdel %{vmusr} 2> /dev/null fi # --------------------------------------------------------------------------- @@ -469,6 +505,9 @@ %verify_permissions -e %{_sbindir}/postdrop %verify_permissions -e %{_sysconfdir}/%{name}/sasl_passwd %verify_permissions -e %{_sbindir}/sendmail +%{fillup_only postfix} +%else +%{fillup_and_insserv -y postfix} %endif # --------------------------------------------------------------------------- @@ -508,25 +547,23 @@ %config(noreplace) %{omc_dir}/%{name}.xml %dir %{_sysconfdir}/%{name} %config %{_sysconfdir}/%{name}/main.cf.default +%config(noreplace) %{_sysconfdir}/%{name}/[^mysql]*[^mysql] %config(noreplace) %{_sysconfdir}/%{name}/access %config(noreplace) %{_sysconfdir}/%{name}/aliases -%config(noreplace) %{_sysconfdir}/%{name}/generic -%config(noreplace) %{_sysconfdir}/%{name}/helo_access %config(noreplace) %{_sysconfdir}/%{name}/canonical +%config(noreplace) %{_sysconfdir}/%{name}/header_checks +%config(noreplace) %{_sysconfdir}/%{name}/helo_access +%config(noreplace) %{_sysconfdir}/%{name}/ldap_aliases.cf %config(noreplace) %{_sysconfdir}/%{name}/main.cf %config(noreplace) %{_sysconfdir}/%{name}/master.cf -%config(noreplace) %{_sysconfdir}/%{name}/openssl_%{name}.conf.in -%config(noreplace) %{_sysconfdir}/%{name}/relocated -%config(noreplace) %{_sysconfdir}/%{name}/transport -%config(noreplace) %{_sysconfdir}/%{name}/virtual -%config(noreplace) %{_sysconfdir}/%{name}/sasl_passwd -%config(noreplace) %{_sysconfdir}/%{name}/sender_canonical +%config(noreplace) %{_sysconfdir}/%{name}/post-install +%config(noreplace) %{_sysconfdir}/%{name}/postfix-files %config(noreplace) %{_sysconfdir}/%{name}/relay %config(noreplace) %{_sysconfdir}/%{name}/relay_ccerts -%config(noreplace) %{_sysconfdir}/%{name}/header_checks -%config(noreplace) %{_sysconfdir}/%{name}/bounce.cf.default -%config(noreplace) %{_sysconfdir}/%{name}/dynamicmaps.cf -%config(noreplace) %{_sysconfdir}/%{name}/ldap_aliases.cf +%config(noreplace) %{_sysconfdir}/%{name}/sasl_passwd +%config(noreplace) %{_sysconfdir}/%{name}/sender_canonical +%config(noreplace) %{_sysconfdir}/%{name}/virtual + %config %{_sysconfdir}/sysconfig/SuSEfirewall2.d/services/smtp %dir %{_sysconfdir}/sasl2/ %config(noreplace) %{_sysconfdir}/sasl2/smtpd.conf @@ -569,9 +606,16 @@ %{_libexecdir}/sendmail %dir %{_libexecdir}/%{name} %{_libexecdir}/%{name}/*[^.so] -%{_libexecdir}/%{name}/dict_ldap.so -%{_libexecdir}/%{name}/dict_pcre.so -%{_libexecdir}/%{name}/dict_tcp.so +%{_libexecdir}/%{name}/postfix-ldap.so +%{_libexecdir}/%{name}/postfix-pcre.so +%{_libexecdir}/%{name}/libpostfix-dns.so +%{_libexecdir}/%{name}/libpostfix-global.so +%{_libexecdir}/%{name}/libpostfix-master.so +%{_libexecdir}/%{name}/libpostfix-tls.so +%{_libexecdir}/%{name}/libpostfix-util.so +%{_libexecdir}/%{name}/main.cf.proto +%{_libexecdir}/%{name}/master.cf.proto + %{conf_backup_dir} %dir %attr(0700,%{name},root) %{pf_data_directory} %{_mandir}/man?/*.gz @@ -603,10 +647,16 @@ %doc %{name}-mysql/%{name}-mysql.sql %config(noreplace) %attr(640, root, %{name}) %{_sysconfdir}/%{name}/*_maps.cf %config(noreplace) %{_sysconfdir}/%{name}/main.cf-mysql -%{_libexecdir}/%{name}/dict_mysql.so +%{_libexecdir}/%{name}/postfix-mysql.so %files postgresql %defattr(-,root,root) -%{_libexecdir}/%{name}/dict_pgsql.so +%{_libexecdir}/%{name}/postfix-pgsql.so + +%if %{with lmdb} +%files lmdb +%defattr(-,root,root) +%{_libexecdir}/%{name}/postfix-lmdb.so +%endif %changelog ++++++ pointer_to_literals.patch ++++++ --- /var/tmp/diff_new_pack.m0Tlbu/_old 2016-06-02 12:38:49.000000000 +0200 +++ /var/tmp/diff_new_pack.m0Tlbu/_new 2016-06-02 12:38:49.000000000 +0200 @@ -54,15 +54,3 @@ if (state->expand_buf == 0) state->expand_buf = vstring_alloc(10); -diff -Nur postfix-2.11.0/src/util/dict_open.c postfix-2.11.0-patched/src/util/dict_open.c ---- postfix-2.11.0/src/util/dict_open.c 2014-02-12 15:19:33.689563158 +0100 -+++ postfix-2.11.0-patched/src/util/dict_open.c 2014-02-12 15:17:28.174612493 +0100 -@@ -554,7 +554,7 @@ - } - - #ifndef NO_DYNAMIC_MAPS --#define STREQ(x,y) (x == y || (x[0] == y[0] && strcmp(x,y) == 0)) -+inline int STREQ(const char *x, const char *y) { return ( x == y || (*(x) == *(y) && strcmp((x), (y)) == 0)); } - - void dict_open_dlinfo(const char *path) - { ++++++ postfix-2.11.7.tar.gz -> postfix-3.1.1.tar.gz ++++++ ++++ 114418 lines of diff (skipped) ++++++ postfix-SuSE.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/postfix-SuSE/config.postfix new/postfix-SuSE/config.postfix --- old/postfix-SuSE/config.postfix 2015-08-12 12:50:59.000000000 +0200 +++ new/postfix-SuSE/config.postfix 2016-05-24 15:18:32.000000000 +0200 @@ -573,20 +573,25 @@ } fi if test "$POSTFIX_SMTP_TLS_SERVER" == "yes" -o "$POSTFIX_SMTP_TLS_SERVER_LEGACY_SUPPORT" == "yes"; then - $PCONF -e "smtpd_use_tls = yes" - if [ -n "$POSTFIX_TLS_CAFILE" -a -s "$POSTFIX_SSL_PATH/$POSTFIX_TLS_CAFILE" ]; then - $PCONF -e "smtpd_tls_CAfile = $POSTFIX_SSL_PATH/$POSTFIX_TLS_CAFILE" + if [ -z "$POSTFIX_TLS_CERTFILE" -o -z "$POSTFIX_TLS_KEYFILE" -o ! -e "$POSTFIX_SSL_PATH/$POSTFIX_TLS_CERTFILE" -o ! -e "$POSTFIX_SSL_PATH/$POSTFIX_TLS_KEYFILE" ]; then + # BNC#981097 config.postfix creates broken main.cf for tls client configuration + warn_user 1>&2 "You have activated POSTFIX_SMTP_TLS_SERVER, but you don't have created or configured certificates." else - $PCONF -e "smtpd_tls_CApath = $POSTFIX_SSL_PATH/certs" + $PCONF -e "smtpd_use_tls = yes" + if [ -n "$POSTFIX_TLS_CAFILE" -a -s "$POSTFIX_SSL_PATH/$POSTFIX_TLS_CAFILE" ]; then + $PCONF -e "smtpd_tls_CAfile = $POSTFIX_SSL_PATH/$POSTFIX_TLS_CAFILE" + else + $PCONF -e "smtpd_tls_CApath = $POSTFIX_SSL_PATH/certs" + fi + $PCONF -e "smtpd_tls_cert_file = $POSTFIX_SSL_PATH/$POSTFIX_TLS_CERTFILE" + $PCONF -e "smtpd_tls_key_file = $POSTFIX_SSL_PATH/$POSTFIX_TLS_KEYFILE" + $PCONF -e "relay_clientcerts = hash:/etc/postfix/relay_ccerts" + $PCONF -e "smtpd_tls_ask_ccert = yes" + $PCONF -e "smtpd_tls_received_header = yes" + touch -m -d "1 minute ago" $TMPDIR/main.cf + CURRENT=$($PCONF -h smtpd_recipient_restrictions) + $PCONF -e "smtpd_recipient_restrictions = permit_tls_clientcerts, $CURRENT" fi - $PCONF -e "smtpd_tls_cert_file = $POSTFIX_SSL_PATH/$POSTFIX_TLS_CERTFILE" - $PCONF -e "smtpd_tls_key_file = $POSTFIX_SSL_PATH/$POSTFIX_TLS_KEYFILE" - $PCONF -e "relay_clientcerts = hash:/etc/postfix/relay_ccerts" - $PCONF -e "smtpd_tls_ask_ccert = yes" - $PCONF -e "smtpd_tls_received_header = yes" - touch -m -d "1 minute ago" $TMPDIR/main.cf - CURRENT=$($PCONF -h smtpd_recipient_restrictions) - $PCONF -e "smtpd_recipient_restrictions = permit_tls_clientcerts, $CURRENT" else $PCONF -e "smtpd_use_tls = no" $PCONF -e "smtpd_tls_CAfile =" @@ -616,10 +621,12 @@ else $PCONF -e "smtp_tls_CApath = $POSTFIX_SSL_PATH/certs" fi - test -s "$POSTFIX_SSL_PATH/$POSTFIX_TLS_CERTFILE" && \ + if [ "$POSTFIX_TLS_CERTFILE" -a -s "$POSTFIX_SSL_PATH/$POSTFIX_TLS_CERTFILE" ]; then $PCONF -e "smtp_tls_cert_file = $POSTFIX_SSL_PATH/$POSTFIX_TLS_CERTFILE" - test -s "$POSTFIX_SSL_PATH/$POSTFIX_TLS_KEYFILE" && \ + fi + if [ "$POSTFIX_TLS_KEYFILE" -a -s "$POSTFIX_SSL_PATH/$POSTFIX_TLS_KEYFILE" ]; then $PCONF -e "smtp_tls_key_file = $POSTFIX_SSL_PATH/$POSTFIX_TLS_KEYFILE" + fi $PCONF -e "smtp_tls_session_cache_database = btree:/var/lib/postfix/smtpd_tls_session_cache" else $PCONF -e "smtp_tls_CAfile =" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/postfix-SuSE/config.postfix.orig new/postfix-SuSE/config.postfix.orig --- old/postfix-SuSE/config.postfix.orig 1970-01-01 01:00:00.000000000 +0100 +++ new/postfix-SuSE/config.postfix.orig 2015-08-12 12:50:59.000000000 +0200 @@ -0,0 +1,1336 @@ +#! /bin/bash +# Copyright (c) 1999-2001 SuSE GmbH Nuernberg, Germany. +# Copyright (c) 2002-2004 SuSE Linux AG +# Copyright (c) 2015 SUSE Linux GmbH +# +# Author: Carsten Hoeger <feedback(a)suse.de> +# Author: Peter Varkoly <varkoly(a)suse.de> + +export LC_ALL=POSIX +export RUN="/var/run/" +if [ -d /run ]; then + export RUN="/run" +fi + +cpifnewer(){ + # remove files, that do no longer exist + if [ -d $2 -a "$(echo $2/*)" != "$2/*" ]; then + for i in $2/*; do + if [ ! -e "/$i" ]; then + echo "removing old or no longer used $i" + rm -f $i + fi + done + fi + test -d $2 || mkdir -p $2 + for i in $1; do + dst=$2/$(basename $i) + + if [ ! -f $dst -a ! -d $dst -a -e $i ]; then + echo "copying missing $dst from $i" + cp -af $i $dst + elif [ ! -d $dst -a $i -nt $dst -o $i -ot $dst ]; then + echo "updating $dst from $i" + cp -af $i $dst + fi + done +} + +update_db() { + while test "x$1" != "x" ; do + pfmap=/etc/postfix/${1%:*} + mode=${1#*:} + if [ "$mode" == "$1" ]; then + mode=644 + fi + chmod $mode ${pfmap} + test -e $pfmap && \ + if test $pfmap -nt ${pfmap}.db -o ! -e ${pfmap}.db ; then + echo "rebuilding ${pfmap}.db" + postmap ${pfmap} + fi + chmod $mode ${pfmap}.db + shift + done +} + +get_alias_maps(){ + test -d /etc/aliases.d && test "$(echo /etc/aliases.d/*)" != "/etc/aliases.d/*" && \ + for i in $(find /etc/aliases.d -maxdepth 1 -type f \ + '!' -regex ".*\.$db\|rpmsave\|rpmorig$" \ + '!' -regex ".*/$\.\|#$.*" \ + '!' -regex ".*~$") ; do + echo -n "$i "; + done +} + +warn_user(){ + tput bold + echo -e "\t*** WARNING ***" + echo -e $1 + echo -e "\t*** WARNING ***" + tput sgr0 +} + +mkchroot(){ + + PF_CHROOT="/var/spool/postfix" + + if [ ! -d "$PF_CHROOT" ]; then + warn_user "\t$PF_CHROOT does not exist!!!\n\ +\tThis should not happen!\n\ +\tPlease reinstall package postfix or create this directory!" + exit 1 + fi + cd "$PF_CHROOT" + + if [ "$(echo "$POSTFIX_MYSQL_CONN" | tr 'A-Z' 'a-z' )" == "socket" -a \ + "$(echo "$POSTFIX_WITH_MYSQL" | tr 'A-Z' 'a-z' )" != "no" ]; then + if [ -n "$(my_print_defaults mysqld)" ]; then + MYSQL_SOCKET=$(my_print_defaults mysqld | grep -e '--socket[[:blank:]=]' | awk -F"=" '{print $2}') + MYSQL_SOCKET_DIR=$(dirname $MYSQL_SOCKET) + CHR_MYSQL_SOCKET=$(echo $MYSQL_SOCKET | sed -e "s,/,,") + CHR_MYSQL_SOCKET_DIR=$(dirname $CHR_MYSQL_SOCKET) + else + warn_user "\t/etc/my.cnf does not exist!!\n\ +\tThis should not happen!\n\ +\tPlease check if postfix-mysql is installed and check for package mysql." + fi + fi + if [ "$(echo "$POSTFIX_SMTP_AUTH_SERVER" | tr 'A-Z' 'a-z' )" != "no" ]; then + SASL_SOCKET_DIR="$RUN/sasl2" + CHR_SASL_SOCKET_DIR="run/sasl2" + fi + if [ "$(echo "$POSTFIX_CHROOT" | tr 'A-Z' 'a-z' )" != "yes" ]; then + # tidy-up in any case, to be safe (bnc#837561) + if grep '[[:blank:]]/var/spool/postfix/proc[[:blank:]]' /proc/mounts &> /dev/null; then + umount /var/spool/postfix/proc + fi + if [ -d etc ]; then + echo "removing postfix chroot environment..." + fi + + if [ -n "$CHR_MYSQL_SOCKET_DIR" ]; then + if grep "$PF_CHROOT"/$CHR_MYSQL_SOCKET_DIR /proc/mounts &> /dev/null; then + umount "$PF_CHROOT"/$CHR_MYSQL_SOCKET_DIR + fi + fi + + if [ -n "$CHR_SASL_SOCKET_DIR" ]; then + if grep "$PF_CHROOT"/$CHR_SASL_SOCKET_DIR /proc/mounts &> /dev/null; then + umount "$PF_CHROOT"/$CHR_SASL_SOCKET_DIR + fi + fi + + rm -rvf etc @lib@ usr var proc + else + echo "checking postfix chroot environment..." + + if [ -e /lib/security/pam_ldap.so ]; then + cpifnewer /etc/openldap/ldap.conf etc/openldap + fi + + if [ "$(echo "$POSTFIX_WITH_MYSQL" | tr 'A-Z' 'a-z' )" != "yes" ]; then + if [ -n "$CHR_MYSQL_SOCKET_DIR" ]; then + if grep "$PF_CHROOT"/$CHR_MYSQL_SOCKET_DIR /proc/mounts &> /dev/null; then + umount "$PF_CHROOT"/$CHR_MYSQL_SOCKET_DIR + fi + fi + fi + + if [ "$(echo "$POSTFIX_MYSQL_CONN" | tr 'A-Z' 'a-z' )" == "socket" -a \ + "$(echo "$POSTFIX_WITH_MYSQL" | tr 'A-Z' 'a-z' )" != "no" ]; then + if [ ! -d $CHR_MYSQL_SOCKET_DIR ]; then + mkdir -p $CHR_MYSQL_SOCKET_DIR + fi + if ! grep $CHR_MYSQL_SOCKET_DIR /proc/mounts &> /dev/null; then + mount -o bind $MYSQL_SOCKET_DIR "$PF_CHROOT"/$CHR_MYSQL_SOCKET_DIR + fi + fi + + if [ "$(echo "$POSTFIX_SMTP_AUTH_SERVER" | tr 'A-Z' 'a-z' )" != "no" ]; then + if [ ! -d $CHR_SASL_SOCKET_DIR ]; then + mkdir -p $CHR_SASL_SOCKET_DIR + fi + if ! grep $CHR_SASL_SOCKET_DIR /proc/mounts &> /dev/null; then + mount -o bind $SASL_SOCKET_DIR "$PF_CHROOT"/$CHR_SASL_SOCKET_DIR + fi + fi + + # smtpd_tls_CApath + CAPATH=`postconf -h smtpd_tls_CApath` + if [ "$CAPATH" ] + then + cpifnewer "$CAPATH/*" ./$CAPATH + rsync -avH --copy-unsafe-links /etc/ssl/certs ./etc/ssl + fi + # smtpd_tls_CAfile + smtpd_tls_CAfile=`postconf -h smtpd_tls_CAfile` + if [ "$smtpd_tls_CAfile" ] + then + DIR=`dirname $smtpd_tls_CAfile` + cpifnewer $smtpd_tls_CAfile ./$DIR + fi + # smtpd_tls_cert_file + smtpd_tls_cert_file=`postconf -h smtpd_tls_cert_file` + if [ "$smtpd_tls_cert_file" ] + then + DIR=`dirname $smtpd_tls_cert_file` + cpifnewer $smtpd_tls_cert_file ./$DIR + fi + # smtpd_tls_key_file + smtpd_tls_key_file=`postconf -h smtpd_tls_key_file` + if [ -n "$smtpd_tls_key_file" ]; then + if [ "$smtpd_tls_key_file" -a $smtpd_tls_key_file != '$smtpd_tls_cert_file' ] + then + DIR=`dirname $smtpd_tls_key_file` + cpifnewer $smtpd_tls_key_file ./$DIR + fi + fi + + # PAM + cpifnewer "/etc/pam.d/*" etc/pam.d + cpifnewer "/@lib@/security/*" @lib@/security + cpifnewer "/@lib@/libpam*" @lib@ + cpifnewer "/usr/@lib@/libcrack.so*" usr/@lib@ + + # SASL + cpifnewer /etc/sasldb2 etc + cpifnewer "/etc/sasl2/*" etc/sasl2 + cpifnewer "/usr/@lib@/sasl2/*" usr/@lib@/sasl2 + cpifnewer "/usr/@lib@/libsasl2*" usr/@lib@ + + # CYRUS + mkdir -p var/lib/imap/socket/ + ln -f /var/lib/imap/socket/lmtp var/lib/imap/socket/lmtp + + cpifnewer "/@lib@/libnss*" @lib@ + cpifnewer "/@lib@/libresolv*" @lib@ + cpifnewer "/@lib@/libdb*" @lib@ + cpifnewer "/@lib@/libxcrypt*" @lib@ + + cpifnewer /etc/host.conf etc + cpifnewer /etc/nsswitch.conf etc + cpifnewer /etc/resolv.conf etc + cpifnewer /etc/services etc + cpifnewer /etc/hosts etc + cpifnewer /etc/passwd etc + + if [ -L /etc/localtime ]; then + if [ -z "$TIMEZONE" -o "$TIMEZONE" == "YAST_ASK" ]; then + warn_user "\tUnable to setup your timezone!\n\ +\tThe logging of the current time in /var/log/mail may be wrong!\n\ +\tPlease set the variable TIMEZONE in /etc/sysconfig/clock!" + else + mkdir -p usr/share/zoneinfo/$(dirname $TIMEZONE) + if [ ! -e /usr/share/zoneinfo/$TIMEZONE ]; then + warn_user "\t$TIMEZONE is not a regular timezone or the corresponding\n\ +\tfile at /usr/share/zoneinfo does not exist" + else + cp -af /usr/share/zoneinfo/$TIMEZONE usr/share/zoneinfo/$TIMEZONE + ln -sf ../usr/share/zoneinfo/$TIMEZONE etc/localtime + fi + fi + else + cpifnewer /etc/localtime etc + fi + + # do not chown -R root /var/spool/postfix/var + # this will break ownership for mysql on suse < 1120 + if [ "$(echo "$POSTFIX_WITH_MYSQL" | tr 'A-Z' 'a-z' )" != "no" ]; then + chown -R root "$PF_CHROOT"/{etc,@lib@,usr} + else + chown -R root "$PF_CHROOT"/{etc,@lib@,usr,var} + fi + fi # "$POSTFIX_CHROOT" +} + +gen_main_cf(){ + TMPDIR=$(mktemp -d /tmp/config.postfix.XXXXXX) || exit 1 + PCONF="/usr/sbin/postconf -c $TMPDIR" + + # needed when for WITH_LDAP + export POSTFIX_WITH_LDAP + # needed when for WITH_MYSQL + export POSTFIX_WITH_MYSQL + MCF_DIR=$TMPDIR + export MCF_DIR + + if [ $? -ne 0 ]; then + warn_user "Can't create temp directory, exiting..." + exit 1 + fi + cp -f /etc/postfix/{main,master}.cf $TMPDIR + + # Some default settings, that seem to be useable, at least to me + $PCONF -e "mail_spool_directory = /var/mail" + $PCONF -e "canonical_maps = hash:/etc/postfix/canonical" + $PCONF -e "virtual_alias_domains = hash:/etc/postfix/virtual" + $PCONF -e "relocated_maps = hash:/etc/postfix/relocated" + if [ "$(echo "$POSTFIX_TRANSPORT_MAPS" | tr 'A-Z' 'a-z' )" != "" ]; then + $PCONF -e "transport_maps = $POSTFIX_TRANSPORT_MAPS" + else + $PCONF -e "transport_maps = hash:/etc/postfix/transport" + fi + $PCONF -e "sender_canonical_maps = hash:/etc/postfix/sender_canonical" + $PCONF -e "masquerade_exceptions = root" + $PCONF -e "masquerade_classes = envelope_sender, header_sender, header_recipient" + if [ -n "${FQHOSTNAME}" ]; then + $PCONF -e "myhostname = $FQHOSTNAME" + fi + $PCONF -e "delay_warning_time = 1h" + $PCONF -e 'message_strip_characters = \0' + + # to be on the save side + $PCONF -e "daemon_directory = @daemon_directory@" + $PCONF -e "readme_directory = @readme_directory@" + $PCONF -e "html_directory = @html_directory@" + $PCONF -e "sample_directory = @sample_directory@" + $PCONF -e "sendmail_path = @sendmail_path@" + $PCONF -e "setgid_group = @setgid_group@" + $PCONF -e "manpage_directory = @manpage_directory@" + $PCONF -e "newaliases_path = @newaliases_path@" + $PCONF -e "mailq_path = @mailq_path@" + if [ "$(echo "$POSTFIX_INET_PROTO" | tr 'A-Z' 'a-z' )" != "" ]; then + $PCONF -e "inet_protocols = $POSTFIX_INET_PROTO" + else + if [ "$( ip addr show dev lo | grep inet6 )" ]; then + $PCONF -e "inet_protocols = all" + else + $PCONF -e "inet_protocols = ipv4" + fi + fi + if test "$SMTPD_LISTEN_REMOTE" == "yes" ; then + if [ "$(echo "$POSTFIX_LISTEN" | tr 'A-Z' 'a-z' )" != "" ]; then + $PCONF -e "inet_interfaces = $POSTFIX_LISTEN" + else + $PCONF -e "inet_interfaces = all" + fi + else + $PCONF -e "inet_interfaces = localhost" + fi + test -n "$POSTFIX_MASQUERADE_DOMAIN" && \ + MASQ_DOMS=$POSTFIX_MASQUERADE_DOMAIN + if [ -n "$FROM_HEADER" -a "$FROM_HEADER" != "YAST_ASK" ]; then + if [ -n "$MASQ_DOMS" ]; then + MASQ_DOMS="$MASQ_DOMS, $FROM_HEADER" + else + MASQ_DOMS="$FROM_HEADER" + fi + fi + $PCONF -e "masquerade_domains = $MASQ_DOMS" + + if test -z "$POSTFIX_LOCALDOMAINS"; then + $PCONF -e 'mydestination = $myhostname, localhost.$mydomain' + else + $PCONF -e "mydestination = $POSTFIX_LOCALDOMAINS" + fi + + # this overrides the previous + if test "$POSTFIX_NULLCLIENT" == "yes"; then + $PCONF -e "mydestination = " + fi + + if test "$POSTFIX_DIALUP" == "yes"; then + $PCONF -e "defer_transports = smtp" + $PCONF -e "mynetworks_style = host" + else + $PCONF -e "defer_transports = " + if test -n "$POSTFIX_ADD_MYNETWORKS_STYLE" + then + $PCONF -e "mynetworks_style = $POSTFIX_ADD_MYNETWORKS_STYLE" + fi + fi + + if test "$POSTFIX_NODNS" == "yes"; then + $PCONF -e "disable_dns_lookups = yes" + else + $PCONF -e "disable_dns_lookups = no" + fi + if test -n "$POSTFIX_RELAYHOST"; then + $PCONF -e "relayhost = $POSTFIX_RELAYHOST" + else + $PCONF -e "relayhost = " + fi + if [ "$(echo "$USE_AMAVIS" | tr 'A-Z' 'a-z' )" != "yes" ]; then + $PCONF -e "content_filter = " + else + $PCONF -e "content_filter = amavis:[127.0.0.1]:10024" + fi + + case "$POSTFIX_MDA" in + procmail) + echo 1>&2 "Setting up procmail as MDA..." + if [ ! -x /usr/bin/procmail ]; then + warn_user 1>&2 "procmail is not installed, using local as MDA!" + $PCONF -e "mailbox_command = " + $PCONF -e "mailbox_transport = " + else + $PCONF -e "mailbox_command = /usr/bin/procmail" + $PCONF -e "mailbox_transport = " + fi + $PCONF -e "disable_mime_output_conversion = no" + ;; + cyrus) + echo 1>&2 "Setting up cyrus-imapd via lmtp as MDA..." + if [ ! -x /usr/lib/cyrus/bin/lmtpd ]; then + warn_user 1>&2 "cyrus-imapd is not installed, using local as MDA!" + $PCONF -e "mailbox_command = " + $PCONF -e "mailbox_transport = " + else + LMTPUNIX=$(grep -E "^[[:space:]]*lmtpunix.*" /etc/cyrus.conf) + if [ -z "$LMTPUNIX" ]; then + warn_user 1>&2 "you have to add\n\ +lmtpunix cmd=\"lmtpd\" listen=\"/var/lib/imap/socket/lmtp\" prefork=1\n\ +to /etc/cyrus.conf" + else + if [ -z "$(echo $LMTPUNIX | grep -E '/var/lib/imap/socket/lmtp')" ]; then + warn_user 1>&2 "the socket to listen on is wrong in /etc/cyrus.conf\n\ +use listen=\"/var/lib/imap/socket/lmtp\" instead!" + fi + fi + $PCONF -e "mailbox_command = " + $PCONF -e "mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp" + $PCONF -e "disable_mime_output_conversion = no" + if [ -z "$(id postfix | grep -E 'groups=.*mail')" ]; then + warn_user 1>&2 "adding postfix user to group mail" + usermod -G mail postfix + fi + fi + ;; + dovecot) + echo 1>&2 "Setting up dovecot as MDA..." + if [ ! -x /usr/lib/dovecot/deliver ]; then + warn_user 1>&2 "dovecot is not installed, using local as MDA!" + $PCONF -e "mailbox_command = " + $PCONF -e "mailbox_transport = " + else + $PCONF -e "mailbox_command = /usr/lib/dovecot/deliver" + $PCONF -e "mailbox_transport = " + fi + $PCONF -e "disable_mime_output_conversion = no" + ;; + local|*) + echo 1>&2 "Setting up postfix local as MDA..." + $PCONF -e "mailbox_command = " + $PCONF -e "mailbox_transport = " + $PCONF -e "disable_mime_output_conversion = no" + ;; + esac + + case "$POSTFIX_BASIC_SPAM_PREVENTION" in + medium) + echo 1>&2 "Setting up medium SPAM protection..." + $PCONF -e "smtpd_sender_restrictions = hash:/etc/postfix/access, reject_unknown_sender_domain" + if test -n "$POSTFIX_RBL_HOSTS"; then + rblhosts=$(echo ${POSTFIX_RBL_HOSTS//,/ }) + clnt_restrictions="" + for i in $rblhosts; do + if [ -z "$clnt_restrictions" ]; then + clnt_restrictions="reject_rbl_client $i" + else + clnt_restrictions="$clnt_restrictions, reject_rbl_client $i" + fi + done + $PCONF -e "smtpd_client_restrictions = $clnt_restrictions" + else + $PCONF -e "smtpd_client_restrictions =" + fi + $PCONF -e "smtpd_helo_required = yes" + $PCONF -e "smtpd_helo_restrictions = " + $PCONF -e "strict_rfc821_envelopes = no" + $PCONF -e "smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination " + ;; + hard) + echo 1>&2 "Setting up hard SPAM protection..." + $PCONF -e "smtpd_sender_restrictions = hash:/etc/postfix/access, reject_unknown_sender_domain" + if test -n "$POSTFIX_RBL_HOSTS"; then + rblhosts=$(echo ${POSTFIX_RBL_HOSTS//,/ }) + clnt_restrictions="" + for i in $rblhosts; do + if [ -z "$clnt_restrictions" ]; then + clnt_restrictions="reject_rbl_client $i" + else + clnt_restrictions="$clnt_restrictions, reject_rbl_client $i" + fi + done + $PCONF -e "smtpd_client_restrictions = permit_mynetworks, $clnt_restrictions, reject_unknown_client" + + else + $PCONF -e \ + "smtpd_client_restrictions = permit_mynetworks, reject_unknown_client" + fi + $PCONF -e "smtpd_helo_required = yes" + $PCONF -e "smtpd_helo_restrictions = permit_mynetworks, reject_invalid_hostname" + $PCONF -e "strict_rfc821_envelopes = yes" + $PCONF -e "smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination" + ;; + custom) + echo 1>&2 "Setting up custom SPAM protection..." + $PCONF -e "smtpd_helo_required = yes" + $PCONF -e "strict_rfc821_envelopes = no" + if [ -n "$POSTFIX_SMTPD_CLIENT_RESTRICTIONS" ]; then + s_clnt_restrictions=$(echo ${POSTFIX_SMTPD_CLIENT_RESTRICTIONS/\ \+/,/ }) + else + echo 1>&2 "No smtpd_client_restrictions defined ... setting to medium ..." + s_clnt_restrictions="reject_unauth_pipelining, reject_unknown_client" + fi + if [ -n "$POSTFIX_RBL_HOSTS" ]; then + rblhosts=$(echo ${POSTFIX_RBL_HOSTS//,/ }) + maps_rbl="" + for i in $rblhosts; do + if [ -z "$maps_rbl" ]; then + maps_rbl="reject_rbl_client $i" + else + maps_rbl="$maps_rbl, reject_rbl_client $i" + fi + done + $PCONF -e "smtpd_client_restrictions = $s_clnt_restrictions, $maps_rbl" + else + $PCONF -e "smtpd_client_restrictions = $s_clnt_restrictions" + fi + if [ -n "$POSTFIX_SMTPD_HELO_RESTRICTIONS" ]; then + helo_restrictions=$(echo ${POSTFIX_SMTPD_HELO_RESTRICTIONS/\ \+/,/ }) + $PCONF -e "smtpd_helo_restrictions = $helo_restrictions" + else + $PCONF -e "smtpd_helo_restrictions = reject_unauth_pipelining, reject_unknown_client" + fi + if [ -n "$POSTFIX_SMTPD_SENDER_RESTRICTIONS" ]; then + sender_restrictions=$(echo ${POSTFIX_SMTPD_SENDER_RESTRICTIONS/\ \+/,/ }) + $PCONF -e "smtpd_sender_restrictions = $sender_restrictions" + else + $PCONF -e "smtpd_sender_restrictions = hash:/etc/postfix/access, reject_unknown_sender_domain" + fi + if [ -n "$POSTFIX_SMTPD_RECIPIENT_RESTRICTIONS" ]; then + rcpt_restrictions=$(echo ${POSTFIX_SMTPD_RECIPIENT_RESTRICTIONS/\ \+/,/ }) + fi + if [ -z "$POSTFIX_SMTPD_RECIPIENT_RESTRICTIONS" ]; then + echo 1>&2 "No smtp_recipient_restrictions defined ... setting to medium ..." + $PCONF -e "smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination" + else + $PCONF -e "smtpd_recipient_restrictions = $rcpt_restrictions" + fi + ;; + *) + if test "$POSTFIX_BASIC_SPAM_PREVENTION" != "off"; then + warn_user 1>&2 "$POSTFIX_BASIC_SPAM_PREVENTION is an invalid value for POSTFIX_BASIC_SPAM_PREVENTION\n\ +using \"off\" instead!" + fi + echo 1>&2 "Setting SPAM protection to \"off\"..." + $PCONF -e "smtpd_sender_restrictions = hash:/etc/postfix/access" + $PCONF -e "smtpd_client_restrictions =" + $PCONF -e "smtpd_helo_required = no" + $PCONF -e "smtpd_helo_restrictions =" + $PCONF -e "strict_rfc821_envelopes = no" + $PCONF -e "smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination" + ;; + esac + + if test "$POSTFIX_SMTP_AUTH" == "yes"; then + $PCONF -e "smtp_sasl_auth_enable = yes" + $PCONF -e "smtp_sasl_security_options = $POSTFIX_SMTP_AUTH_OPTIONS" + $PCONF -e "smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd" + else + $PCONF -e "smtp_sasl_auth_enable = no" + $PCONF -e "smtp_sasl_security_options = " + $PCONF -e "smtp_sasl_password_maps = " + fi + + if test "$POSTFIX_SMTP_AUTH_SERVER" == "yes"; then + if [ -f /etc/sasl2/smtpd.conf ]; then + grep saslauthd /etc/sasl2/smtpd.conf >/dev/null && { + checkproc -p $RUN/sasl2/saslauthd.pid /usr/sbin/saslauthd || { + warn_user 1>&2 "You are using saslauthd as pwcheck_method in /etc/sasl2/smtpd.conf,\n\ +but saslauthd is not running." + } + } + elif [ -f /usr/@lib@/sasl2/smtpd.conf ]; then + grep saslauthd /usr/@lib@/sasl2/smtpd.conf >/dev/null && { + checkproc -p $RUN/sasl2/saslauthd.pid /usr/sbin/saslauthd || { + warn_user 1>&2 "You are using saslauthd as pwcheck_method in /usr/@lib@/sasl2/smtpd.conf,\n\ +but saslauthd is not running." + } + } + else + warn_user 1>&2 "You have activated POSTFIX_SMTP_AUTH_SERVER, but you don't have /etc/sasl2/smtpd.conf (nor /usr/@lib@/sasl2/smtpd.conf)" + fi + $PCONF -e "smtpd_sasl_auth_enable= yes" + touch -m -d "1 minute ago" $TMPDIR/main.cf + CURRENT=$($PCONF -h smtpd_client_restrictions) + $PCONF -e "smtpd_client_restrictions= permit_sasl_authenticated, $CURRENT" + touch -m -d "1 minute ago" $TMPDIR/main.cf + CURRENT=$($PCONF -h smtpd_recipient_restrictions) + $PCONF -e "smtpd_recipient_restrictions= permit_sasl_authenticated, $CURRENT" + else + $PCONF -e "smtpd_sasl_auth_enable= no" + fi + + + if test "$POSTFIX_SMTP_TLS_SERVER_LEGACY_SUPPORT" == "yes"; then + grep -E '^smtps' /etc/services >/dev/null || { + warn_user 1>&2 "adding service \"smtps\" to /etc/services" + echo "smtps 465/tcp # smtp over SSL" >> /etc/services + } + fi + if test "$POSTFIX_SMTP_TLS_SERVER" == "yes" -o "$POSTFIX_SMTP_TLS_SERVER_LEGACY_SUPPORT" == "yes"; then + $PCONF -e "smtpd_use_tls = yes" + if [ -n "$POSTFIX_TLS_CAFILE" -a -s "$POSTFIX_SSL_PATH/$POSTFIX_TLS_CAFILE" ]; then + $PCONF -e "smtpd_tls_CAfile = $POSTFIX_SSL_PATH/$POSTFIX_TLS_CAFILE" + else + $PCONF -e "smtpd_tls_CApath = $POSTFIX_SSL_PATH/certs" + fi + $PCONF -e "smtpd_tls_cert_file = $POSTFIX_SSL_PATH/$POSTFIX_TLS_CERTFILE" + $PCONF -e "smtpd_tls_key_file = $POSTFIX_SSL_PATH/$POSTFIX_TLS_KEYFILE" + $PCONF -e "relay_clientcerts = hash:/etc/postfix/relay_ccerts" + $PCONF -e "smtpd_tls_ask_ccert = yes" + $PCONF -e "smtpd_tls_received_header = yes" + touch -m -d "1 minute ago" $TMPDIR/main.cf + CURRENT=$($PCONF -h smtpd_recipient_restrictions) + $PCONF -e "smtpd_recipient_restrictions = permit_tls_clientcerts, $CURRENT" + else + $PCONF -e "smtpd_use_tls = no" + $PCONF -e "smtpd_tls_CAfile =" + $PCONF -e "smtpd_tls_CApath =" + $PCONF -e "smtpd_tls_cert_file =" + $PCONF -e "smtpd_tls_key_file =" + $PCONF -e "relay_clientcerts =" + $PCONF -e "smtpd_tls_ask_ccert = no" + $PCONF -e "smtpd_tls_received_header = no" + fi + + if test "$POSTFIX_SMTP_TLS_CLIENT" == "no"; then + $PCONF -e "smtp_use_tls = no" + $PCONF -e "smtp_enforce_tls = no" + fi + if test "$POSTFIX_SMTP_TLS_CLIENT" == "yes"; then + $PCONF -e "smtp_use_tls = yes" + $PCONF -e "smtp_enforce_tls = no" + fi + if test "$POSTFIX_SMTP_TLS_CLIENT" == "must"; then + $PCONF -e "smtp_use_tls = yes" + $PCONF -e "smtp_enforce_tls = yes" + fi + if test "$POSTFIX_SMTP_TLS_CLIENT" = "yes" -o "$POSTFIX_SMTP_TLS_CLIENT" = "must" ; then + if [ -n "$POSTFIX_TLS_CAFILE" -a -s "$POSTFIX_SSL_PATH/$POSTFIX_TLS_CAFILE" ]; then + $PCONF -e "smtp_tls_CAfile = $POSTFIX_SSL_PATH/$POSTFIX_TLS_CAFILE" + else + $PCONF -e "smtp_tls_CApath = $POSTFIX_SSL_PATH/certs" + fi + test -s "$POSTFIX_SSL_PATH/$POSTFIX_TLS_CERTFILE" && \ + $PCONF -e "smtp_tls_cert_file = $POSTFIX_SSL_PATH/$POSTFIX_TLS_CERTFILE" + test -s "$POSTFIX_SSL_PATH/$POSTFIX_TLS_KEYFILE" && \ + $PCONF -e "smtp_tls_key_file = $POSTFIX_SSL_PATH/$POSTFIX_TLS_KEYFILE" + $PCONF -e "smtp_tls_session_cache_database = btree:/var/lib/postfix/smtpd_tls_session_cache" + else + $PCONF -e "smtp_tls_CAfile =" + $PCONF -e "smtp_tls_CApath =" + $PCONF -e "smtp_tls_cert_file =" + $PCONF -e "smtp_tls_key_file =" + $PCONF -e "smtp_tls_session_cache_database =" + fi + + ALLMAPS="hash:/etc/aliases" + for i in $(get_alias_maps); do + ALLMAPS="${ALLMAPS}, hash:$i" + done + $PCONF -e "alias_maps = $ALLMAPS" + + for i in $(echo ${!POSTFIX_ADD_*}); do + touch -m -d "1 minute ago" $TMPDIR/main.cf + pfkey=$(echo ${i#POSTFIX_ADD_}) + pfval=$(eval "echo \$$i") + if [ -z "$($PCONF $pfkey 2>/dev/null)" ]; then + pfkey=$(echo ${i#POSTFIX_ADD_} | tr '[:upper:]' '[:lower:]') + if [ -z "$($PCONF $pfkey 2>/dev/null)" ]; then + warn_user 1>&2 "unknown parameter $i ignored" + else + #old style uppercase written variable + $PCONF -e "$pfkey = $pfval" + fi + else + $PCONF -e "$pfkey = $pfval" + fi + done + + perl -e 'use strict; + +my $mncf = "$ENV{MCF_DIR}/main.cf"; +my $line; + +my $with_ldap = + defined $ENV{POSTFIX_WITH_LDAP} ? $ENV{POSTFIX_WITH_LDAP} : "no"; + +$with_ldap = lc($with_ldap); + +my $with_mysql = + defined $ENV{POSTFIX_WITH_MYSQL} ? $ENV{POSTFIX_WITH_MYSQL} : "no"; + +$with_mysql = lc($with_mysql); + +open(MNCF,"<$mncf") || die "unable to open $mncf: $!"; + +while( <MNCF> ) { + chomp; + + if( /\#?(virtual_alias_maps\s=\s).*/ ) { + if ($with_mysql ne "yes" && $with_ldap ne "yes") { + $line = $1."hash:/etc/postfix/virtual"; + } elsif ($with_ldap eq "yes" && $with_mysql ne "yes") { + $line = $1."hash:/etc/postfix/virtual ldap:/etc/postfix/ldap_aliases.cf"; + } elsif ($with_mysql eq "yes" && $with_ldap ne "yes") { + $line = $1."hash:/etc/postfix/virtual mysql:/etc/postfix/mysql_virtual_alias_maps.cf"; + } elsif ($with_mysql eq "yes" && $with_ldap eq "yes") { + $line = $1."hash:/etc/postfix/virtual ldap:/etc/postfix/ldap_aliases.cf mysql:/etc/postfix/mysql_virtual_alias_maps.cf"; + } + } elsif( /\#?(virtual_uid_maps\s=.*)/ ) { + if ($with_mysql ne "yes") { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /\#?(virtual_gid_maps\s=.*)/ ) { + if ($with_mysql ne "yes") { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /\#?(virtual_minimum_uid\s=.*)/ ) { + if ($with_mysql ne "yes") { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /\#?(virtual_mailbox_base\s=.*)/ ) { + if ($with_mysql ne "yes") { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /\#?(virtual_mailbox_domains\s=.*)/ ) { + if ($with_mysql ne "yes") { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /\#?(virtual_mailbox_limit\s=.*)/ ) { + if ($with_mysql ne "yes") { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /\#?(virtual_mailbox_maps\s=.*)/ ) { + if ($with_mysql ne "yes") { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /\#?(virtual_transport\s=.*)/ ) { + if ($with_mysql ne "yes") { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /\#?(virtual_mailbox_limit_maps\s=.*)/ ) { + if ($with_mysql ne "yes") { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /\#?(virtual_mailbox_limit_override\s=.*)/ ) { + if ($with_mysql ne "yes") { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /\#?(virtual_maildir_limit_message\s=.*)/ ) { + if ($with_mysql ne "yes") { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /\#?(virtual_overquota_bounce\s=.*)/ ) { + if ($with_mysql ne "yes") { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /^(relay_domains\s=\s).*/ ) { + if ($with_mysql ne "yes") { + $line = $1."\$mydestination, hash:/etc/postfix/relay"; + } else { + $line = $1."\$mydestination, hash:/etc/postfix/relay, mysql:/etc/postfix/mysql_relay_domains_maps.cf"; + } + } else { + $line = $_; + } + + if( $line =~ /^\#/ ) { + print $line."\n"; + next; + } + + print $line."\n"; + +}' > $TMPDIR/new.cf + + mv $TMPDIR/new.cf $TMPDIR/main.cf + cat $TMPDIR/main.cf + rm -rf $TMPDIR +} + +gen_amavisd_cf(){ + cp /etc/amavisd.conf /etc/amavisd.conf.back + export FQHOSTNAME + if [ -n "${FQHOSTNAME}" ]; then + perl -e 'use strict; +open(ACF,"</etc/amavisd.conf") || die "unable to open /etc/amavisd.conf: $!"; + +my @CONF = (); +my $myhostname = $ENV{FQHOSTNAME}; +my ($h,$mydomain)= split /\./, $myhostname, 2; +my $ismyhostname = 0; +while( <ACF> ) { + if ( s/^\$myhostname = .*;/\$myhostname = "$myhostname";/ ) + { + next if $ismyhostname; + $ismyhostname = 1; + } + s/^\$mydomain = .*;/\$mydomain = "$mydomain";/; + push @CONF, $_ +} +close(ACF); +pop @CONF; +if ( ! $ismyhostname ) { + push @CONF, "\$myhostname = \"$myhostname\";\n"; +} +push @CONF, "1;"; +open(OUT,">/etc/amavisd.conf"); +print OUT @CONF; +close(OUT); +' + fi +} + +gen_master_cf(){ + export POSTFIX_LAPTOP + export POSTFIX_CHROOT + export POSTFIX_NULLCLIENT + export USE_AMAVIS + export POSTFIX_SMTP_AUTH_SERVER + export POSTFIX_SMTP_TLS_SERVER + export POSTFIX_SMTP_TLS_SERVER_LEGACY_SUPPORT + export POSTFIX_SMTP_TLS_CLIENT + + perl -e 'use strict; + +my $mcf = "/etc/postfix/master.cf"; +my $line; + +my $laptop = + defined $ENV{POSTFIX_LAPTOP} ? $ENV{POSTFIX_LAPTOP} : "no"; +my $nullclient = + defined $ENV{POSTFIX_NULLCLIENT} ? $ENV{POSTFIX_NULLCLIENT} : "no"; +my $chroot = + defined $ENV{POSTFIX_CHROOT} ? $ENV{POSTFIX_CHROOT} : "yes"; +my $use_amavis = + defined $ENV{USE_AMAVIS} ? $ENV{USE_AMAVIS} : "no"; +my $tlsserver = + defined $ENV{POSTFIX_SMTP_TLS_SERVER} ? $ENV{POSTFIX_SMTP_TLS_SERVER} : "no"; +my $sslserver = + defined $ENV{POSTFIX_SMTP_TLS_SERVER_LEGACY_SUPPORT} ? $ENV{POSTFIX_SMTP_TLS_SERVER_LEGACY_SUPPORT} : "no"; +my $tlsclient = + defined $ENV{POSTFIX_SMTP_TLS_CLIENT} ? $ENV{POSTFIX_SMTP_TLS_CLIENT} : "no"; +my $authserver = + defined $ENV{POSTFIX_SMTP_AUTH_SERVER} ? $ENV{POSTFIX_SMTP_AUTH_SERVER} : "no"; +my $normalize = {}; + + +$laptop = lc($laptop); +$chroot = lc($chroot); +$nullclient = lc($nullclient); +$use_amavis = lc($use_amavis); +$tlsserver = lc($tlsserver); +$tlsclient = lc($tlsclient); +$authserver = lc($authserver); + +open(MCF,"<$mcf") || die "unable to open $mcf: $!"; + +while( <MCF> ) { + chomp; + + if( /^\#?\s*(smtp\s+inet.*?smtpd)/ ) { + if( defined $normalize->{$1} ) { next; } else { $normalize->{$1} = 1; } + if ($nullclient eq "yes") { + $line = "#".$1; + } else { + $line = $1; + } + if ( $use_amavis eq "yes" ) { + $line =~ /(\#?\s*smtp\s+inet\s+[yn-]?\s+[yn-]?\s+[yn-]?\s+[0-9?yn-]?\s+)[0-9-]+(.*)/; + $line = $1."-".$2; + } else { + $line =~ /(\#?\s*smtp\s+inet\s+[yn-]?\s+[yn-]?\s+[yn-]?\s+[0-9?yn-]?\s+)[0-9-]+(.*)/; + $line = $1."-".$2; + } + ## amavis + } elsif( /^\#?\s*(amavis\s+unix.*)/ ) { + if ($use_amavis ne "yes") { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /^\#?\s\s(-o\s+smtp_data_done_timeout=.*)/ ) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+smtp_send_xforward_command=.*)/ ) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+disable_dns_lookups=.*)/ ) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+max_use=.*)/ ) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + ## end amavis + } elsif( /^\#?\s*(local\s+unix.*)/ ) { + if( defined $normalize->{$1} ) { next; } else { $normalize->{$1} = 1; } + if ($nullclient eq "yes") { + $line = "#".$1; + } else { + $line = $1; + } + ## submission + } elsif( /^\#?\s*(submission\s+inet.*?smtpd)/ ) { + if( defined $normalize->{$1} ) { next; } else { $normalize->{$1} = 1; } + if ( $tlsserver ne "yes" ) { + $line = "#".$1; + } else { + $line = $1; + } + if ( $use_amavis eq "yes" ) { + $line =~ /(^\#?\s*submission\s+inet\s+[yn-]?\s+[yn-]?\s+[yn-]?\s+[0-9?yn-]?\s+)[0-9-]+(.*)/; + $line = $1."10".$2; + } else { + $line =~ /(^\#?\s*submission\s+inet\s+[yn-]?\s+[yn-]?\s+[yn-]?\s+[0-9?yn-]?\s+)[0-9-]+(.*)/; + $line = $1."-".$2; + } + } elsif( /^\#?\s{3}(-o\s+syslog_name=.*)/ ) { + if ( $tlsserver ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif( /^\#?\s{3}(-o\s+smtpd_tls_security_level=.*)/ ) { + if ( $tlsserver ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif( /^\#?\s{3}(-o\s+smtpd_sasl_auth_enable=.*)/ ) { + if ( $tlsserver ne "yes" && $authserver ne "yes") { + $line = "# ".$1; + } else { + $line = " ".$1; + } + ## end submission + ## smtps + } elsif( /^\#?\s*(smtps\s+inet.*?smtpd)/ ) { + if( defined $normalize->{$1} ) { next; } else { $normalize->{$1} = 1; } + if ( $sslserver ne "yes" ) { + $line = "#".$1; + } else { + $line = $1; + } + if ( $use_amavis eq "yes" ) { + $line =~ /(^\#?\s*smtps\s+inet\s+[yn-]?\s+[yn-]?\s+[yn-]?\s+[0-9?yn-]?\s+)[0-9-]+(.*)/; + $line = $1."10".$2; + } else { + $line =~ /(^\#?\s*smtps\s+inet\s+[yn-]?\s+[yn-]?\s+[yn-]?\s+[0-9?yn-]?\s+)[0-9-]+(.*)/; + $line = $1."-".$2; + } + } elsif( /^\#?\s{4}(-o\s+syslog_name=.*)/ ) { + if ( $sslserver ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif( /^\#?\s{4}(-o\s+smtpd_tls_wrappermode=.*)/ ) { + if ( $sslserver ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif( /^\#?\s{4}(-o\s+content_filter=.*)/ ) { + if ( $sslserver ne "yes" && $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif( /^\#?\s{4}(-o\s+smtpd_sasl_auth_enable=.*)/ ) { + if ( $sslserver ne "yes" && $authserver ne "yes") { + $line = "# ".$1; + } else { + $line = " ".$1; + } + ## end smtps + ## tlsmgr + } elsif( /^\#?\s*(tlsmgr\s+unix.*)/ ) { + if( defined $normalize->{$1} ) { next; } else { $normalize->{$1} = 1; } + if ( $tlsclient ne "yes" && $tlsserver ne "yes" && $sslserver ne "yes" ) { + $line = "#".$1; + } else { + $line = $1; + } + ## end tlsmgr + ## localhost_10025 + } elsif( /^\#?\s*(localhost:10025\s+inet.*)/ ) { + if( defined $normalize->{$1} ) { next; } else { $normalize->{$1} = 1; } + if ( $use_amavis ne "yes" ) { + $line = "#".$1; + } else { + $line = $1; + } + } elsif ( /^\#?\s\s(-o\s+content_filter=.*)/ ) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+smtpd_delay_reject=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + # next should match + # # -o smtpd_client_restrictions=permit_mynetworks,reject + # and not + # # -o smtpd_client_restrictions=permit_sasl_authenticated,reject + } elsif ( /^\#?\s\s(-o\s+smtpd_client_restrictions=)(.*)/) { + if ( $2 eq "permit_mynetworks,reject") { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1.$2; + } else { + $line = " ".$1.$2; + } + } + } elsif ( /^\#?\s\s(-o\s+smtpd_helo_restrictions=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+smtpd_sender_restrictions=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+smtpd_recipient_restrictions=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+smtpd_data_restrictions=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+smtpd_end_of_data_restrictions=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+smtpd_restriction_classes=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+mynetworks=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+smtpd_error_sleep_time=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+smtpd_soft_error_limit=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+smtpd_hard_error_limit=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+smtpd_client_connection_count_limit=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+smtpd_client_connection_rate_limit=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+receive_override_options=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + if( $line !~ /receive_override_options=no_unknown_recipient_checks,no_header_body_checks/ ) + { + $line = " -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks,no_address_mappings"; + } + } + } elsif ( /^\#?\s\s(-o\s+local_header_rewrite_clients=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+local_recipient_maps=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + } elsif ( /^\#?\s\s(-o\s+relay_recipient_maps=.*)/) { + if ( $use_amavis ne "yes" ) { + $line = "# ".$1; + } else { + $line = " ".$1; + } + ## end localhost_10025 + } elsif( /^(\#?\s*(?:pickup|qmgr)\s+)(?:fifo|unix)(\s+.*)/ ) { + if( defined $normalize->{$1} ) { next; } else { $normalize->{$1} = 1; } + if ( $laptop eq "yes" ) { + $line = $1."unix".$2; + } else { + $line = $1."fifo".$2; + } + } else { + $line = $_; + } + + if( $line =~ /^\#/ ) { + print $line."\n"; + next; + } + + my $match = 0; + foreach my $serv ( ( "smtp", "pickup", "cleanup", "rewrite", + "bounce", "defer", "showq", "error", + "lmtp", "smtps", "tlsmgr", "localhost:10025" ) ) { + if( $line =~ /^$serv\s+/ ) { + $line =~ /(^$serv\s+\w+\s+[yn-]?\s+[yn-]?\s+)[yn-]?(.*)/; + print $1.( $chroot eq "yes" ? "y" : "n" ).$2."\n"; + $match = 1; + } else { + next; + } + } + print $line."\n" if ! $match; +}' + +} + +update_cf() { + while test "x$1" != "x" ; do + B=$( find /etc/postfix/${1} -printf %CY%Cm%Cd%CI%CM ) + cp /etc/postfix/${1} "@conf_backup_dir@/${1}$B" + cp /etc/postfix/${1} "@conf_backup_dir@/${1}" + eval gen_${1/\./_} > /tmp/${1}.config + mv /tmp/${1}.config /etc/postfix/${1}; + shift + done +} + +restore_cf() { + while test "x$1" != "x" ; do + warn_user "/etc/postfix/${1}: zero file size or missing, restoring +from @conf_backup_dir@/${1}" + if [ ! -s @conf_backup_dir@/$1 ]; then + warn_user "@conf_backup_dir@/${1}: zero file size or missing, exiting..." + exit 1 + fi + cp --remove-destination @conf_backup_dir@/$1 /etc/postfix/$1 + + update_cf $1 + shift + done +} + +gen_CA() { + openssl=/usr/bin/openssl + sslpath=$POSTFIX_SSL_PATH + sslconfig=$sslpath/openssl_postfix.conf + date="$(date)" + + oldmask=$(umask) + umask 077 + mkdir -p $sslpath/private + mkdir -p $sslpath/certs + mkdir -p $sslpath/newcerts + + test -f $sslpath/serial || \ + echo 01 > $sslpath/serial + touch $sslpath/index.txt + sed -e "s/@POSTFIX_SSL_COUNTRY@/$POSTFIX_SSL_COUNTRY/" \ + -e "s/@POSTFIX_SSL_STATE@/$POSTFIX_SSL_STATE/" \ + -e "s/@POSTFIX_SSL_LOCALITY@/$POSTFIX_SSL_LOCALITY/" \ + -e "s/@POSTFIX_SSL_ORGANIZATION@/$POSTFIX_SSL_ORGANIZATION/" \ + -e "s/@POSTFIX_SSL_ORGANIZATIONAL_UNIT@/$POSTFIX_SSL_ORGANIZATIONAL_UNIT/" \ + -e "s/@POSTFIX_SSL_COMMON_NAME@/$POSTFIX_SSL_COMMON_NAME/" \ + -e "s/@POSTFIX_SSL_EMAIL_ADDRESS@/$POSTFIX_SSL_EMAIL_ADDRESS/" \ + -e "s/@RANDOM@/${RANDOM}${RANDOM}/" \ + -e "s/@COMMENT@/generated by onfig.postfix at $date/" \ + /etc/postfix/openssl_postfix.conf.in > $sslconfig + + echo "creating CA request/certificate..." + $openssl req -days 2000 -config $sslconfig -new -x509 -nodes \ + -keyout $sslpath/private/cakey.pem -out $sslpath/$POSTFIX_TLS_CAFILE 2>/dev/null || { + echo "error creating CA request/certificate" + rm -rf $sslpath + umask $oldmask + return + } + + echo "creating certificate request..." + $openssl req -config $sslconfig -new -nodes -keyout \ + $sslpath/$POSTFIX_TLS_KEYFILE -out $sslpath/certs/postfixreq.pem 2>/dev/null || { + echo "error creating certificate request" + rm -rf $sslpath + umask $oldmask + return + } + + echo "signing server certificate..." + $openssl ca -config $sslconfig -notext -batch \ + -out $sslpath/$POSTFIX_TLS_CERTFILE \ + -infiles $sslpath/certs/postfixreq.pem 2>/dev/null || { + echo "error signing server certificate" + rm -rf $sslpath + umask $oldmask + return + } + + chmod 755 $sslpath + chmod 755 $sslpath/certs + chmod 644 $sslpath/cacert.pem + umask $oldmask +} + +############################################################################### +#################################### MAIN ##################################### +############################################################################### + +r=$ROOT + +echo "Reading $r/etc/sysconfig and updating the system..." + +test -s $r/etc/sysconfig/postfix || { + echo "No $r/etc/sysconfig/postfix found." + exit 1 +} +. $r/etc/sysconfig/postfix + +# this file contains generic mail setup information +test -s $r/etc/sysconfig/mail || { + echo "No $r/etc/sysconfig/mail found." + exit 1 +} +. $r/etc/sysconfig/mail + +# We may need TIMEZONE for chroot setup +test -s $r/etc/sysconfig/clock && . $r/etc/sysconfig/clock + +# Do not try to get a valid hostname as per boo#934060 +if [ -z "$POSTFIX_MYHOSTNAME" ]; then + FQHOSTNAME= +else + FQHOSTNAME=$POSTFIX_MYHOSTNAME +fi + +# check whether we want to use amavis +if [ -x /usr/sbin/amavisd ]; then + test -s $r/etc/sysconfig/amavis && . $r/etc/sysconfig/amavis + if [ "$USE_AMAVIS" = "yes" ]; then + gen_amavisd_cf + chkconfig amavis on + fi +fi + +# call mkchroot. The conditions what to do take place in this function. +mkchroot + +# restore main.cf and master.cf, if they had been removed by accident +test -z "$r" && { + if [ ! -s /etc/postfix/main.cf ]; then + restore_cf main.cf + fi + + if [ ! -s /etc/postfix/master.cf ]; then + restore_cf master.cf + fi +} + +if test "$MAIL_CREATE_CONFIG" = "yes"; then + test -z "$r" && update_cf master.cf main.cf +fi + +PFVERSION=$(/usr/sbin/postconf -h mail_version) +test -z "$PFVERSION" && { + echo "ERROR - unable to determine the version of postfix, you are running" + echo "This should not happen. Exit..." + exit 1 +} +PFMAJOR=${PFVERSION:0:1} + +if test -z "$r" && test "$POSTFIX_SMTP_TLS_SERVER" == yes ; then + test -d $POSTFIX_SSL_PATH || gen_CA +fi + +if test -z "$r" && test "$POSTFIX_UPDATE_MAPS" == yes ; then + test -e /etc/aliases && \ + if test /etc/aliases -nt /etc/aliases.db \ + -o ! -e /etc/aliases.db ; then + echo "Rebuilding /etc/aliases.db." + /usr/bin/newaliases + fi + update_db $POSTFIX_MAP_LIST + + for i in $(get_alias_maps); do + if test $i -nt $i.db -o ! -e $i.db; then + echo "Rebuilding $i.db" + /usr/sbin/postalias $i + fi + done + + /usr/sbin/postfix reload > /dev/null 2>&1 +fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/postfix-SuSE/sysconfig.postfix new/postfix-SuSE/sysconfig.postfix --- old/postfix-SuSE/sysconfig.postfix 2014-02-12 16:00:37.000000000 +0100 +++ new/postfix-SuSE/sysconfig.postfix 2016-05-24 06:29:07.000000000 +0200 @@ -382,7 +382,7 @@ # POSTFIX_SMTP_TLS_SERVER_LEGACY_SUPPORT="no" -## Type: yesno +## Type: list(no,yes,must) ## Default: no ## Config: postfix # ++++++ postfix-main.cf.patch ++++++ --- /var/tmp/diff_new_pack.m0Tlbu/_old 2016-06-02 12:38:51.000000000 +0200 +++ /var/tmp/diff_new_pack.m0Tlbu/_new 2016-06-02 12:38:51.000000000 +0200 @@ -1,8 +1,6 @@ -Index: conf/main.cf -=================================================================== ---- conf/main.cf.orig -+++ conf/main.cf -@@ -548,6 +548,7 @@ unknown_local_recipient_reject_code = 55 +--- conf/main.cf.orig 2015-04-01 10:56:39.000000000 +0000 ++++ conf/main.cf 2016-03-16 09:28:51.968093319 +0000 +@@ -567,6 +567,7 @@ # #smtpd_banner = $myhostname ESMTP $mail_name #smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) @@ -10,7 +8,7 @@ # PARALLEL DELIVERY TO THE SAME DESTINATION # -@@ -654,4 +655,120 @@ sample_directory = +@@ -673,4 +674,120 @@ # readme_directory: The location of the Postfix README files. # readme_directory = ++++++ postfix-master.cf.patch ++++++ --- /var/tmp/diff_new_pack.m0Tlbu/_old 2016-06-02 12:38:51.000000000 +0200 +++ /var/tmp/diff_new_pack.m0Tlbu/_new 2016-06-02 12:38:51.000000000 +0200 @@ -1,9 +1,7 @@ -Index: conf/master.cf -=================================================================== ---- conf/master.cf.orig -+++ conf/master.cf -@@ -10,32 +10,38 @@ - # (yes) (yes) (yes) (never) (100) +--- conf/master.cf.orig 2016-03-16 09:28:26.256321206 +0100 ++++ conf/master.cf 2016-03-16 09:35:02.748681617 +0100 +@@ -10,6 +10,11 @@ + # (yes) (yes) (no) (never) (100) # ========================================================================== smtp inet n - n - - smtpd +#amavis unix - - n - 4 smtp @@ -14,57 +12,18 @@ #smtp inet n - n - 1 postscreen #smtpd pass - - n - - smtpd #dnsblog unix - - n - 0 dnsblog - #tlsproxy unix - - n - 0 tlsproxy - #submission inet n - n - - smtpd --# -o syslog_name=postfix/submission --# -o smtpd_tls_security_level=encrypt --# -o smtpd_sasl_auth_enable=yes --# -o smtpd_reject_unlisted_recipient=no --# -o smtpd_client_restrictions=$mua_client_restrictions --# -o smtpd_helo_restrictions=$mua_helo_restrictions --# -o smtpd_sender_restrictions=$mua_sender_restrictions --# -o smtpd_recipient_restrictions= --# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject --# -o milter_macro_daemon_name=ORIGINATING -+# -o syslog_name=postfix/submission -+# -o smtpd_tls_security_level=encrypt -+# -o smtpd_sasl_auth_enable=yes -+# -o smtpd_reject_unlisted_recipient=no -+# -o smtpd_client_restrictions=$mua_client_restrictions -+# -o smtpd_helo_restrictions=$mua_helo_restrictions -+# -o smtpd_sender_restrictions=$mua_sender_restrictions -+# -o smtpd_recipient_restrictions= -+# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -+# -o milter_macro_daemon_name=ORIGINATING +@@ -28,6 +33,7 @@ #smtps inet n - n - - smtpd --# -o syslog_name=postfix/smtps --# -o smtpd_tls_wrappermode=yes --# -o smtpd_sasl_auth_enable=yes --# -o smtpd_reject_unlisted_recipient=no --# -o smtpd_client_restrictions=$mua_client_restrictions --# -o smtpd_helo_restrictions=$mua_helo_restrictions --# -o smtpd_sender_restrictions=$mua_sender_restrictions --# -o smtpd_recipient_restrictions= --# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject --# -o milter_macro_daemon_name=ORIGINATING -+# -o syslog_name=postfix/smtps -+# -o smtpd_tls_wrappermode=yes -+# -o content_filter=smtp:[127.0.0.1]:10024 -+# -o smtpd_sasl_auth_enable=yes -+# -o smtpd_reject_unlisted_recipient=no -+# -o smtpd_client_restrictions=$mua_client_restrictions -+# -o smtpd_helo_restrictions=$mua_helo_restrictions -+# -o smtpd_sender_restrictions=$mua_sender_restrictions -+# -o smtpd_recipient_restrictions= -+# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -+# -o milter_macro_daemon_name=ORIGINATING - #628 inet n - n - - qmqpd - pickup unix n - n 60 1 pickup - cleanup unix n - n - 0 cleanup -@@ -61,6 +67,26 @@ local unix - n n - virtual unix - n n - - virtual + # -o syslog_name=postfix/smtps + # -o smtpd_tls_wrappermode=yes ++# -o content_filter=smtp:[127.0.0.1]:10024 + # -o smtpd_sasl_auth_enable=yes + # -o smtpd_reject_unlisted_recipient=no + # -o smtpd_client_restrictions=$mua_client_restrictions +@@ -62,6 +68,27 @@ lmtp unix - - n - - lmtp anvil unix - - n - 1 anvil + scache unix - - n - 1 scache +#localhost:10025 inet n - n - - smtpd +# -o content_filter= +# -o smtpd_delay_reject=no @@ -85,10 +44,11 @@ +# -o local_header_rewrite_clients= +# -o local_recipient_maps= +# -o relay_recipient_maps= - scache unix - - n - 1 scache ++ # # ==================================================================== -@@ -95,7 +121,7 @@ scache unix - - n + # Interfaces to non-Postfix software. Be sure to examine the manual +@@ -95,7 +122,7 @@ # Also specify in main.cf: cyrus_destination_recipient_limit=1 # #cyrus unix - n n - - pipe @@ -97,7 +57,7 @@ # # ==================================================================== # -@@ -128,3 +154,10 @@ scache unix - - n +@@ -128,3 +155,10 @@ #mailman unix - n n - - pipe # flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py # ${nexthop} ${user} ++++++ postfix-post-install.patch ++++++ --- /var/tmp/diff_new_pack.m0Tlbu/_old 2016-06-02 12:38:51.000000000 +0200 +++ /var/tmp/diff_new_pack.m0Tlbu/_new 2016-06-02 12:38:51.000000000 +0200 @@ -1,13 +0,0 @@ -Index: conf/post-install -=================================================================== ---- conf/post-install.orig -+++ conf/post-install -@@ -708,7 +708,7 @@ EOF - # Postfix 2.2. - # Add missing tlsmgr service to master.cf. - -- grep '^tlsmgr.*tlsmgr' $config_directory/master.cf >/dev/null || { -+ grep '^#*tlsmgr.*tlsmgr' $config_directory/master.cf >/dev/null || { - echo Editing $config_directory/master.cf, adding missing entry for tlsmgr service - cat >>$config_directory/master.cf <<EOF || exit 1 - tlsmgr unix - - n 1000? 1 tlsmgr ++++++ postfix-ssl-release-buffers.patch ++++++ --- /var/tmp/diff_new_pack.m0Tlbu/_old 2016-06-02 12:38:51.000000000 +0200 +++ /var/tmp/diff_new_pack.m0Tlbu/_new 2016-06-02 12:38:51.000000000 +0200 @@ -1,10 +1,8 @@ -Index: src/tls/tls_client.c -=================================================================== ---- src/tls/tls_client.c.orig -+++ src/tls/tls_client.c -@@ -356,6 +356,12 @@ TLS_APPL_STATE *tls_client_init(const TL - return (0); - } +--- src/tls/tls_client.c.orig 2016-03-16 09:45:17.686921418 +0100 ++++ src/tls/tls_client.c 2016-03-16 09:46:24.431617807 +0100 +@@ -369,6 +369,12 @@ + SSL_CTX_set_security_level(client_ctx, 0); + #endif + /* Keep memory usage as low as possible */ + @@ -15,15 +13,14 @@ /* * See the verify callback in tls_verify.c */ -Index: src/tls/tls_server.c -=================================================================== ---- src/tls/tls_server.c.orig -+++ src/tls/tls_server.c -@@ -426,6 +426,11 @@ TLS_APPL_STATE *tls_server_init(const TL - return (0); - } +--- src/tls/tls_server.c.orig 2016-03-16 09:45:39.487150299 +0100 ++++ src/tls/tls_server.c 2016-03-16 09:51:32.230678857 +0100 +@@ -451,6 +451,12 @@ + SSL_CTX_set_security_level(server_ctx, 0); + #endif -+ /* Keep memory usage as low as possible */ ++ /* Keep memory usage as low as possible */ ++ +#ifdef SSL_MODE_RELEASE_BUFFERS + SSL_CTX_set_mode(server_ctx, SSL_MODE_RELEASE_BUFFERS); +#endif ++++++ postfix-vda-v13-2.10.0.patch -> postfix-vda-v13-3.10.0.patch ++++++ --- /work/SRC/openSUSE:Factory/postfix/postfix-vda-v13-2.10.0.patch 2014-06-26 08:00:36.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.postfix.new/postfix-vda-v13-3.10.0.patch 2016-06-02 12:38:47.000000000 +0200 @@ -1281,12 +1281,24 @@ + return (deliver_status); } -diff -uNr postfix-2.10.0.orig/src/virtual/virtual.c postfix-2.10.0/src/virtual/virtual.c ---- postfix-2.10.0.orig/src/virtual/virtual.c 2011-02-19 01:46:06.000000000 +0100 -+++ postfix-2.10.0/src/virtual/virtual.c 2013-06-07 13:21:22.840143270 +0200 -@@ -335,12 +335,30 @@ - char *var_mail_spool_dir; /* XXX dependency fix */ +diff -uNr postfix-2.10.0.orig/src/virtual/virtual.h postfix-2.10.0/src/virtual/virtual.h +--- postfix-2.10.0.orig/src/virtual/virtual.h 2006-01-08 00:59:47.000000000 +0100 ++++ postfix-2.10.0/src/virtual/virtual.h 2013-06-07 13:21:22.841143270 +0200 +@@ -34,6 +34,9 @@ + extern MAPS *virtual_mailbox_maps; + extern MAPS *virtual_uid_maps; + extern MAPS *virtual_gid_maps; ++extern MAPS *virtual_mailbox_limit_maps; ++extern MAPS *virtual_maildir_limit_message_maps; ++extern MAPS *virtual_maildir_filter_maps; + + /* + * User attributes: these control the privileges for delivery to external +--- postfix-3.1.0/src/virtual/virtual.c.orig 2016-03-16 09:58:37.790856521 +0100 ++++ postfix-3.1.0/src/virtual/virtual.c 2016-03-16 10:04:44.267207460 +0100 +@@ -347,12 +347,28 @@ bool var_strict_mbox_owner; + char *var_virt_dsn_filter; +char *var_virt_mailbox_limit_maps; +bool var_virt_mailbox_limit_inbox; @@ -1301,7 +1313,6 @@ +bool var_virt_maildir_filter; +char *var_virt_maildir_filter_maps; + -+ /* * Mappings. */ @@ -1311,46 +1322,33 @@ +MAPS *virtual_mailbox_limit_maps; +MAPS *virtual_maildir_limit_message_maps; +MAPS *virtual_maildir_filter_maps; -+ /* * Bit masks. -@@ -450,15 +468,28 @@ - */ - virtual_mailbox_maps = - maps_create(VAR_VIRT_MAILBOX_MAPS, var_virt_mailbox_maps, -- DICT_FLAG_LOCK | DICT_FLAG_PARANOID); -+ DICT_FLAG_LOCK); +@@ -475,6 +491,19 @@ + DICT_FLAG_LOCK | DICT_FLAG_PARANOID + | DICT_FLAG_UTF8_REQUEST); - virtual_uid_maps = - maps_create(VAR_VIRT_UID_MAPS, var_virt_uid_maps, -- DICT_FLAG_LOCK | DICT_FLAG_PARANOID); -+ DICT_FLAG_LOCK); - - virtual_gid_maps = - maps_create(VAR_VIRT_GID_MAPS, var_virt_gid_maps, -- DICT_FLAG_LOCK | DICT_FLAG_PARANOID); -+ DICT_FLAG_LOCK); -+ + virtual_mailbox_limit_maps = + maps_create(VAR_VIRT_MAILBOX_LIMIT_MAPS, var_virt_mailbox_limit_maps, -+ DICT_FLAG_LOCK); ++ DICT_FLAG_LOCK | DICT_FLAG_UTF8_REQUEST ); + + virtual_maildir_limit_message_maps = + maps_create(VAR_VIRT_MAILDIR_LIMIT_MESSAGE_MAPS, var_virt_maildir_limit_message_maps, -+ DICT_FLAG_LOCK); ++ DICT_FLAG_LOCK | DICT_FLAG_UTF8_REQUEST ); + + virtual_maildir_filter_maps = + maps_create(VAR_VIRT_MAILDIR_FILTER_MAPS, var_virt_maildir_filter_maps, -+ DICT_FLAG_LOCK); ++ DICT_FLAG_LOCK | DICT_FLAG_UTF8_REQUEST ); ++ + - virtual_mbox_lock_mask = mbox_lock_mask(var_virt_mailbox_lock); } -@@ -510,10 +541,22 @@ - VAR_VIRT_GID_MAPS, DEF_VIRT_GID_MAPS, &var_virt_gid_maps, 0, 0, + +@@ -526,6 +555,12 @@ VAR_VIRT_MAILBOX_BASE, DEF_VIRT_MAILBOX_BASE, &var_virt_mailbox_base, 1, 0, VAR_VIRT_MAILBOX_LOCK, DEF_VIRT_MAILBOX_LOCK, &var_virt_mailbox_lock, 1, 0, + VAR_VIRT_DSN_FILTER, DEF_VIRT_DSN_FILTER, &var_virt_dsn_filter, 0, 0, + VAR_VIRT_MAILBOX_LIMIT_MAPS, DEF_VIRT_MAILBOX_LIMIT_MAPS, &var_virt_mailbox_limit_maps, 0, 0, + VAR_VIRT_MAILDIR_LIMIT_MESSAGE, DEF_VIRT_MAILDIR_LIMIT_MESSAGE, &var_virt_maildir_limit_message, 1, 0, + VAR_VIRT_MAILDIR_LIMIT_MESSAGE_MAPS, DEF_VIRT_MAILDIR_LIMIT_MESSAGE_MAPS, &var_virt_maildir_limit_message_maps, 0, 0, @@ -1360,34 +1358,3 @@ 0, }; static const CONFIG_BOOL_TABLE bool_table[] = { - VAR_STRICT_MBOX_OWNER, DEF_STRICT_MBOX_OWNER, &var_strict_mbox_owner, -+ VAR_VIRT_MAILBOX_LIMIT_INBOX, DEF_VIRT_MAILBOX_LIMIT_INBOX, &var_virt_mailbox_limit_inbox, -+ VAR_VIRT_MAILBOX_LIMIT_OVERRIDE, DEF_VIRT_MAILBOX_LIMIT_OVERRIDE, &var_virt_mailbox_limit_override, -+ VAR_VIRT_MAILDIR_EXTENDED, DEF_VIRT_MAILDIR_EXTENDED, &var_virt_maildir_extended, -+ VAR_VIRT_OVERQUOTA_BOUNCE, DEF_VIRT_OVERQUOTA_BOUNCE, &var_virt_overquota_bounce, -+ VAR_VIRT_TRASH_COUNT, DEF_VIRT_TRASH_COUNT, &var_virt_trash_count, -+ VAR_VIRT_MAILDIR_FILTER, DEF_VIRT_MAILDIR_FILTER, &var_virt_maildir_filter, - 0, - }; - -@@ -530,6 +573,7 @@ - MAIL_SERVER_PRE_INIT, pre_init, - MAIL_SERVER_POST_INIT, post_init, - MAIL_SERVER_PRE_ACCEPT, pre_accept, -+ MAIL_SERVER_BOOL_TABLE, bool_table, - MAIL_SERVER_PRIVILEGED, - 0); - } -diff -uNr postfix-2.10.0.orig/src/virtual/virtual.h postfix-2.10.0/src/virtual/virtual.h ---- postfix-2.10.0.orig/src/virtual/virtual.h 2006-01-08 00:59:47.000000000 +0100 -+++ postfix-2.10.0/src/virtual/virtual.h 2013-06-07 13:21:22.841143270 +0200 -@@ -34,6 +34,9 @@ - extern MAPS *virtual_mailbox_maps; - extern MAPS *virtual_uid_maps; - extern MAPS *virtual_gid_maps; -+extern MAPS *virtual_mailbox_limit_maps; -+extern MAPS *virtual_maildir_limit_message_maps; -+extern MAPS *virtual_maildir_filter_maps; - - /* - * User attributes: these control the privileges for delivery to external

1 0

commit python3-pyserial for openSUSE:Factory
by root＠hilbert.suse.de 02 Jun '16

02 Jun '16

Hello community, here is the log from the commit of package python3-pyserial for openSUSE:Factory checked in at 2016-06-02 12:38:40 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python3-pyserial (Old) and /work/SRC/openSUSE:Factory/.python3-pyserial.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python3-pyserial" Changes: -------- --- /work/SRC/openSUSE:Factory/python3-pyserial/python3-pyserial-doc.changes 2016-05-23 16:38:31.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.python3-pyserial.new/python3-pyserial-doc.changes 2016-06-02 12:38:41.000000000 +0200 @@ -1,0 +2,30 @@ +Sun May 29 03:41:42 UTC 2016 - arun(a)gmx.de + +- update to version 3.1: + * Improvements: + + improve error handling in "alt://" handler + + "socket://" internally used select, improves timeout behavior + + initial state of RTS/DTR: ignore error when setting on open + posix (support connecting to pty's) + + code style updates + + posix: remove "number_to_device" which is not called anymore + + add cancel_read and cancel_write to win32 and posix + implementations + * Bugfixes: + + [#68] aio: catch errors and close connection + + [#87] hexlify: update codec for Python 2 + + [#100] setPort not implemented + + [#101] bug in serial.threaded.Packetizer with easy fix + + [#104] rfc2217 and socket: set timeout in create_connection + + [#107] miniterm.py fails to exit on failed serial port + * Bugfixes (posix): + + [#59] fixes for RTS/DTR handling on open + + [#77] list_ports_osx: add missing import + + [#85] serialposix.py _set_rs485_mode() tries to read + non-existing rs485_settings.delay_rts_before_send + + [#96] patch: native RS485 is never enabled + * Bugfixes (win32): + + fix bad super call and duplicate old-style __init__ call + + [#80] list_ports: Compatibility issue between Windows/Linux + +------------------------------------------------------------------- python3-pyserial.changes: same change Old: ---- pyserial-3.0.1.tar.gz New: ---- pyserial-3.1.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python3-pyserial-doc.spec ++++++ --- /var/tmp/diff_new_pack.7I3THr/_old 2016-06-02 12:38:42.000000000 +0200 +++ /var/tmp/diff_new_pack.7I3THr/_new 2016-06-02 12:38:42.000000000 +0200 @@ -17,7 +17,7 @@ Name: python3-pyserial-doc -Version: 3.0.1 +Version: 3.1 Release: 0 Url: https://github.com/pyserial/pyserial Summary: Documentation for python3-pyserial @@ -25,8 +25,8 @@ Group: Documentation/HTML Source: https://files.pythonhosted.org/packages/source/p/pyserial/pyserial-%{versio… BuildRoot: %{_tmppath}/%{name}-%{version}-build -BuildRequires: python3-pyserial = %{version} BuildRequires: python3-Sphinx +BuildRequires: python3-pyserial = %{version} Recommends: python3-pyserial = %{version} BuildArch: noarch ++++++ python3-pyserial.spec ++++++ --- /var/tmp/diff_new_pack.7I3THr/_old 2016-06-02 12:38:42.000000000 +0200 +++ /var/tmp/diff_new_pack.7I3THr/_new 2016-06-02 12:38:42.000000000 +0200 @@ -17,7 +17,7 @@ Name: python3-pyserial -Version: 3.0.1 +Version: 3.1 Release: 0 Url: https://github.com/pyserial/pyserial Summary: Python Serial Port Extension ++++++ pyserial-3.0.1.tar.gz -> pyserial-3.1.tar.gz ++++++ ++++ 6650 lines of diff (skipped)

1 0

commit valgrind for openSUSE:Factory
by root＠hilbert.suse.de 02 Jun '16

02 Jun '16

Hello community, here is the log from the commit of package valgrind for openSUSE:Factory checked in at 2016-06-02 12:38:34 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/valgrind (Old) and /work/SRC/openSUSE:Factory/.valgrind.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "valgrind" Changes: -------- --- /work/SRC/openSUSE:Factory/valgrind/valgrind.changes 2016-05-03 09:33:24.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.valgrind.new/valgrind.changes 2016-06-02 12:38:35.000000000 +0200 @@ -1,0 +2,5 @@ +Sat May 28 11:01:13 UTC 2016 - dmueller(a)suse.com + +- add vex-r3197.diff (bsc#981447) + +------------------------------------------------------------------- @@ -24 +29 @@ -- update to 3.11.0: +- update to 3.11.0 (fate#319608): New: ---- vex-r3197.diff ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ valgrind.spec ++++++ --- /var/tmp/diff_new_pack.lNCEXm/_old 2016-06-02 12:38:36.000000000 +0200 +++ /var/tmp/diff_new_pack.lNCEXm/_new 2016-06-02 12:38:36.000000000 +0200 @@ -41,7 +41,8 @@ Patch6: r15702.diff Patch7: r15792.diff Patch8: r15802.diff -Patch100: vex-r3210.diff +Patch100: vex-r3197.diff +Patch101: vex-r3210.diff BuildRequires: automake BuildRequires: docbook-xsl-stylesheets BuildRequires: docbook_4 @@ -122,6 +123,7 @@ %patch7 %patch8 %patch100 +%patch101 %build export FLAGS="%{optflags}" ++++++ vex-r3197.diff ++++++ ------------------------------------------------------------------------ r3197 | mjw | 2015-10-01 14:31:19 +0200 (Do, 01. Okt 2015) | 5 Zeilen Don't advertise RDRAND in cpuid for Core-i7-4910-like avx2 machine. Bug#353370. In amd64g_dirtyhelper_CPUID_avx2 we set the RDRAND bit but we don't implement support for RDRAND. Turn the bit off so programs don't try to use RDRAND when running under valgrind. ------------------------------------------------------------------------ Index: priv/guest_amd64_helpers.c =================================================================== --- VEX/priv/guest_amd64_helpers.c (Revision 3196) +++ VEX/priv/guest_amd64_helpers.c (Revision 3197) @@ -3101,7 +3101,8 @@ void amd64g_dirtyhelper_CPUID_avx2 ( Vex SET_ABCD(0x0000000d, 0x756e6547, 0x6c65746e, 0x49656e69); break; case 0x00000001: - SET_ABCD(0x000306c3, 0x02100800, 0x7ffafbff, 0xbfebfbff); + /* Don't advertise RDRAND support, bit 30 in ECX. */ + SET_ABCD(0x000306c3, 0x02100800, 0x3ffafbff, 0xbfebfbff); break; case 0x00000002: SET_ABCD(0x76036301, 0x00f0b6ff, 0x00000000, 0x00c10000);

1 0

commit gnome-terminal for openSUSE:Factory
by root＠hilbert.suse.de 02 Jun '16

02 Jun '16

Hello community, here is the log from the commit of package gnome-terminal for openSUSE:Factory checked in at 2016-06-02 12:38:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gnome-terminal (Old) and /work/SRC/openSUSE:Factory/.gnome-terminal.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "gnome-terminal" Changes: -------- --- /work/SRC/openSUSE:Factory/gnome-terminal/gnome-terminal.changes 2016-05-23 17:30:50.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.gnome-terminal.new/gnome-terminal.changes 2016-06-02 12:38:30.000000000 +0200 @@ -1,0 +2,6 @@ +Tue May 24 10:52:39 UTC 2016 - mgorse(a)suse.com + +- Remove gnome-core obsoletes; it is from 2002 or so and not + relevant now. + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gnome-terminal.spec ++++++ --- /var/tmp/diff_new_pack.upYB6i/_old 2016-06-02 12:38:30.000000000 +0200 +++ /var/tmp/diff_new_pack.upYB6i/_new 2016-06-02 12:38:30.000000000 +0200 @@ -47,7 +47,6 @@ BuildRequires: pkgconfig(vte-2.91) >= 0.44.2 BuildRequires: pkgconfig(x11) Recommends: %{name}-lang -Obsoletes: gnome-core BuildRoot: %{_tmppath}/%{name}-%{version}-build Requires(pre): filesystem %if 0%{?sle_version}

1 0

commit python3-vcversioner for openSUSE:Factory
by root＠hilbert.suse.de 02 Jun '16

02 Jun '16

Hello community, here is the log from the commit of package python3-vcversioner for openSUSE:Factory checked in at 2016-06-02 12:38:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python3-vcversioner (Old) and /work/SRC/openSUSE:Factory/.python3-vcversioner.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "python3-vcversioner" Changes: -------- --- /work/SRC/openSUSE:Factory/python3-vcversioner/python3-vcversioner.changes 2016-05-17 17:13:39.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.python3-vcversioner.new/python3-vcversioner.changes 2016-06-02 12:38:23.000000000 +0200 @@ -1,0 +2,9 @@ +Sat May 28 03:04:49 UTC 2016 - arun(a)gmx.de + +- update to version 2.16.0.0: + * And now update classifiers. + * Drop support for 3.2, it's gone from coverage, for one. + * And now make the test less astounding. + * Only set the version on the distribution metadata. + +------------------------------------------------------------------- @@ -6 +14,0 @@ - Old: ---- vcversioner-2.14.0.0.tar.gz New: ---- vcversioner-2.16.0.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python3-vcversioner.spec ++++++ --- /var/tmp/diff_new_pack.pPZq0e/_old 2016-06-02 12:38:24.000000000 +0200 +++ /var/tmp/diff_new_pack.pPZq0e/_new 2016-06-02 12:38:24.000000000 +0200 @@ -17,7 +17,7 @@ Name: python3-vcversioner -Version: 2.14.0.0 +Version: 2.16.0.0 Release: 0 Summary: Use version control tags to discover version numbers License: ISC ++++++ vcversioner-2.14.0.0.tar.gz -> vcversioner-2.16.0.0.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vcversioner-2.14.0.0/PKG-INFO new/vcversioner-2.16.0.0/PKG-INFO --- old/vcversioner-2.14.0.0/PKG-INFO 2014-07-15 22:49:51.000000000 +0200 +++ new/vcversioner-2.16.0.0/PKG-INFO 2016-04-12 17:16:06.000000000 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 1.1 Name: vcversioner -Version: 2.14.0.0 +Version: 2.16.0.0 Summary: Use version control tags to discover version numbers Home-page: https://github.com/habnabit/vcversioner Author: Aaron Gallagher @@ -312,6 +312,7 @@ Classifier: Programming Language :: Python :: 2.6 Classifier: Programming Language :: Python :: 2.7 Classifier: Programming Language :: Python :: 3 -Classifier: Programming Language :: Python :: 3.2 Classifier: Programming Language :: Python :: 3.3 +Classifier: Programming Language :: Python :: 3.4 +Classifier: Programming Language :: Python :: 3.5 Classifier: Topic :: Software Development :: Version Control diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vcversioner-2.14.0.0/setup.py new/vcversioner-2.16.0.0/setup.py --- old/vcversioner-2.14.0.0/setup.py 2014-07-15 22:23:05.000000000 +0200 +++ new/vcversioner-2.16.0.0/setup.py 2016-04-12 17:14:31.000000000 +0200 @@ -27,8 +27,9 @@ 'Programming Language :: Python :: 2.6', 'Programming Language :: Python :: 2.7', 'Programming Language :: Python :: 3', - 'Programming Language :: Python :: 3.2', 'Programming Language :: Python :: 3.3', + 'Programming Language :: Python :: 3.4', + 'Programming Language :: Python :: 3.5', 'Topic :: Software Development :: Version Control', ], license='ISC', diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vcversioner-2.14.0.0/vcversioner.egg-info/PKG-INFO new/vcversioner-2.16.0.0/vcversioner.egg-info/PKG-INFO --- old/vcversioner-2.14.0.0/vcversioner.egg-info/PKG-INFO 2014-07-15 22:49:51.000000000 +0200 +++ new/vcversioner-2.16.0.0/vcversioner.egg-info/PKG-INFO 2016-04-12 17:16:06.000000000 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 1.1 Name: vcversioner -Version: 2.14.0.0 +Version: 2.16.0.0 Summary: Use version control tags to discover version numbers Home-page: https://github.com/habnabit/vcversioner Author: Aaron Gallagher @@ -312,6 +312,7 @@ Classifier: Programming Language :: Python :: 2.6 Classifier: Programming Language :: Python :: 2.7 Classifier: Programming Language :: Python :: 3 -Classifier: Programming Language :: Python :: 3.2 Classifier: Programming Language :: Python :: 3.3 +Classifier: Programming Language :: Python :: 3.4 +Classifier: Programming Language :: Python :: 3.5 Classifier: Topic :: Software Development :: Version Control diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vcversioner-2.14.0.0/vcversioner.py new/vcversioner-2.16.0.0/vcversioner.py --- old/vcversioner-2.14.0.0/vcversioner.py 2014-07-15 22:33:49.000000000 +0200 +++ new/vcversioner-2.16.0.0/vcversioner.py 2016-04-12 17:14:31.000000000 +0200 @@ -262,4 +262,4 @@ """ - dist.version = dist.metadata.version = find_version(**value).version + dist.metadata.version = find_version(**value).version diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/vcversioner-2.14.0.0/version.txt new/vcversioner-2.16.0.0/version.txt --- old/vcversioner-2.14.0.0/version.txt 2014-07-15 22:49:51.000000000 +0200 +++ new/vcversioner-2.16.0.0/version.txt 2016-04-12 17:16:06.000000000 +0200 @@ -1 +1 @@ -2.14.0.0-0-g260b867 \ No newline at end of file +2.16.0.0-0-g72f8f0a \ No newline at end of file

1 0