Postsrsd Versions Save

...because it would not have been a proper pre-release without some obvious bugs 😉

• Properly rewrite SRS addresses with database backend
• Fix crash due to faulty log statement
• More tests!

This is a complete rewrite of PostSRSd, with the following features:

• Proper configuration file, no more fiddling with environment variables
• Now with socketmap interface (requires Postfix 2.10+)
• Unix socket support
• New rewrite mode with database backend, supports unlimited email address length
• Experimental Milter support

This is a pre-release for anyone who is interested in the new features. Please give it a try, report bugs and give feedback!

• Explicitly clear O_NONBLOCK to avoid inherited non-blocking sockets on some operating systems
• Do not close all file descriptors up to _SC_MAX_OPEN, that limit can be absurdly high and hang PostSRSd for minutes
• Check for faketime before using it in the unit tests

• SECURITY FIX: The subprocess that talks to Postfix could be caused to hang with a very long email address (see 077be98 for details, thanks to Mateusz Jończyk for the report). [Note: This bug seems only exploitable if Postfix is tricked into passing a whole list of addresses as single query to PostSRSd, such as it was observed in #37.]

• SECURITY FIX [CVE-2020-35573]: PostSRSd could be tricked into consuming a lot of CPU time with an SRS address that has a very long time stamp tag (see 4733fb1 for details)
• Fixed a bug where PostSRSd would occasionally create invalid SRS addresses if the used secret is extremely long

• Another hotfix release
• Fix issues with systemd service file

I'm sorry for any disruption that might have occurred. I learned my lesson not to trust in my assumed knowledge about systemd too much, and set up a proper Github Action test.

• Add new "always rewrite" option -A
• Improved syslog messages for PostSRSd activity
• Fix AppArmor and SELinux profiles
• Add blackbost testing for PostSRSd daemon

• Improve systemd auto detection
• Drop group privileges as well as user privileges
• Adopt modifications from Debian (Thanks to Oxan van Leeuwen)
• Clean up CMakeLists.txt. The minimum required version is CMake 3.0 now.

• Bugfix release
• Fix endianness issue with SHA-1 implementation
• Improve unit test to minimize the risk of spurious failures due to hash prefix collisions

• Maintenance release.
• Fix SElinux policy.
• Fix handling of excluded domains in systemd startup file.
• Close file descriptors on startup.
• Add a few more configuration options.