Received: by mail.netbsd.org (Postfix, from userid 605) id 888FF84E78; Thu, 8 Nov 2018 20:57:31 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 8587384E77 for ; Thu, 8 Nov 2018 20:57:30 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.netbsd.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id NGvsqlddgYxr for ; Thu, 8 Nov 2018 20:57:28 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.NetBSD.org [IPv6:2001:470:a085:999:28c:faff:fe03:5984]) by mail.netbsd.org (Postfix) with ESMTP id 99F8D84D31 for ; Thu, 8 Nov 2018 20:57:28 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id 868A6FB1F; Thu, 8 Nov 2018 20:57:28 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_154171064881510" MIME-Version: 1.0 Date: Thu, 8 Nov 2018 20:57:28 +0000 From: "Amitai Schleier" Subject: CVS commit: pkgsrc/mail/qmail-run To: pkgsrc-changes@NetBSD.org Reply-To: schmonz@netbsd.org X-Mailer: log_accum Message-Id: <20181108205728.868A6FB1F@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_154171064881510 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: schmonz Date: Thu Nov 8 20:57:28 UTC 2018 Modified Files: pkgsrc/mail/qmail-run: MESSAGE Makefile pkgsrc/mail/qmail-run/files: fixsmtpio qmailofmipd.sh qmailpop3d.sh qmailsmtpd.sh tcp.ofmip tcp.smtp Log Message: Bump acceptutils dependency to get STARTTLS support in fixsmtpio(8) (obviating the need for qmail-smtpd(8) to be patched to link OpenSSL). Make TLS configurable for submission, POP3, and now also incoming SMTP: - "yes" (startup will fail if cert or DH params are missing) - "no" (even if they're present, don't offer TLS) - "auto" (the default: offer TLS iff they're present) Mention TLS setup in MESSAGE. Delay SMTP greeting by 2 seconds. Enable zen.spamhaus.org RBL. Bump version. To generate a diff of this commit: cvs rdiff -u -r1.11 -r1.12 pkgsrc/mail/qmail-run/MESSAGE cvs rdiff -u -r1.54 -r1.55 pkgsrc/mail/qmail-run/Makefile cvs rdiff -u -r1.1 -r1.2 pkgsrc/mail/qmail-run/files/fixsmtpio \ pkgsrc/mail/qmail-run/files/tcp.smtp cvs rdiff -u -r1.14 -r1.15 pkgsrc/mail/qmail-run/files/qmailofmipd.sh cvs rdiff -u -r1.23 -r1.24 pkgsrc/mail/qmail-run/files/qmailpop3d.sh cvs rdiff -u -r1.19 -r1.20 pkgsrc/mail/qmail-run/files/qmailsmtpd.sh cvs rdiff -u -r1.3 -r1.4 pkgsrc/mail/qmail-run/files/tcp.ofmip Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_154171064881510 Content-Disposition: inline Content-Length: 13672 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/mail/qmail-run/MESSAGE diff -u pkgsrc/mail/qmail-run/MESSAGE:1.11 pkgsrc/mail/qmail-run/MESSAGE:1.12 --- pkgsrc/mail/qmail-run/MESSAGE:1.11 Sun Oct 28 15:01:57 2018 +++ pkgsrc/mail/qmail-run/MESSAGE Thu Nov 8 20:57:28 2018 @@ -1,5 +1,5 @@ =========================================================================== -$NetBSD: MESSAGE,v 1.11 2018/10/28 15:01:57 schmonz Exp $ +$NetBSD: MESSAGE,v 1.12 2018/11/08 20:57:28 schmonz Exp $ Please read ${PREFIX}/share/doc/qmail-run/README.pkgsrc. @@ -19,7 +19,7 @@ Incoming SMTP deliveries: - Optionally list qmail-rcptcheck programs in control/rcptchecks. - Optionally list qmail-qfilter programs in control/smtpfilters. -Outgoing submissions with SMTP AUTH over TLS: +Outgoing authentication-only submission: - Set qmailofmipd=YES in /etc/rc.conf. - Optionally list qmail-qfilter programs in control/ofmipfilters. @@ -29,4 +29,7 @@ User-controlled ofmipd address rewriting Fetching Maildirs via POP3: - Set qmailpop3d=YES in /etc/rc.conf. +TLS for incoming and outgoing SMTP, submission, and POP3: +- Create cert and DH params as instructed by the qmail package. + =========================================================================== Index: pkgsrc/mail/qmail-run/Makefile diff -u pkgsrc/mail/qmail-run/Makefile:1.54 pkgsrc/mail/qmail-run/Makefile:1.55 --- pkgsrc/mail/qmail-run/Makefile:1.54 Sat Nov 3 17:08:26 2018 +++ pkgsrc/mail/qmail-run/Makefile Thu Nov 8 20:57:28 2018 @@ -1,7 +1,7 @@ -# $NetBSD: Makefile,v 1.54 2018/11/03 17:08:26 schmonz Exp $ +# $NetBSD: Makefile,v 1.55 2018/11/08 20:57:28 schmonz Exp $ # -DISTNAME= qmail-run-20181103 +DISTNAME= qmail-run-20181108 CATEGORIES= mail MASTER_SITES= # empty DISTFILES= # empty @@ -10,10 +10,11 @@ MAINTAINER= schmonz@NetBSD.org COMMENT= Configures qmail to receive and deliver mail LICENSE= 2-clause-bsd +DEPENDS+= greetdelay-[0-9]*:../../mail/greetdelay DEPENDS+= pkg_alternatives-[0-9]*:../../pkgtools/pkg_alternatives DEPENDS_QMAIL= qmail>=1.03nb36:../../mail/qmail DEPENDS+= ${DEPENDS_QMAIL} -DEPENDS+= qmail-acceptutils>=20181027:../../mail/qmail-acceptutils +DEPENDS+= qmail-acceptutils>=20181108:../../mail/qmail-acceptutils DEPENDS+= qmail-qfilter>1.5nb1:../../mail/qmail-qfilter DEPENDS+= qmail-rejectutils-[0-9]*:../../mail/qmail-rejectutils Index: pkgsrc/mail/qmail-run/files/fixsmtpio diff -u pkgsrc/mail/qmail-run/files/fixsmtpio:1.1 pkgsrc/mail/qmail-run/files/fixsmtpio:1.2 --- pkgsrc/mail/qmail-run/files/fixsmtpio:1.1 Wed Oct 24 15:46:54 2018 +++ pkgsrc/mail/qmail-run/files/fixsmtpio Thu Nov 8 20:57:28 2018 @@ -30,10 +30,6 @@ AUTHUP_USER:greeting::5*:15:&fixsmtpio_n # If server times out, hide message, and tell authup to stop trying AUTHUP_USER:timeout::*:16: -# Don't permit server to advertise further AUTH or STARTTLS +# Don't permit server to advertise or respond to further AUTH AUTHUP_USER:ehlo::250?AUTH*:: -AUTHUP_USER:ehlo::250?STARTTLS:: - -# Don't permit client to initiate further AUTH or STARTTLS AUTHUP_USER:auth:NOOP :*::502 unimplemented (#5.5.1) -AUTHUP_USER:starttls:NOOP :*::502 unimplemented (#5.5.1) Index: pkgsrc/mail/qmail-run/files/tcp.smtp diff -u pkgsrc/mail/qmail-run/files/tcp.smtp:1.1 pkgsrc/mail/qmail-run/files/tcp.smtp:1.2 --- pkgsrc/mail/qmail-run/files/tcp.smtp:1.1 Wed Oct 24 15:46:54 2018 +++ pkgsrc/mail/qmail-run/files/tcp.smtp Thu Nov 8 20:57:28 2018 @@ -1,2 +1,2 @@ 127.:allow,RELAYCLIENT="" -:allow,QMAILQUEUE="@PREFIX@/bin/qmail-qfilter-smtpd-queue",RCPTCHECK="@PREFIX@/bin/qmail-rcptcheck" +:allow,UCSPITLS="",GREETDELAY="2",QMAILQUEUE="@PREFIX@/bin/qmail-qfilter-smtpd-queue",RCPTCHECK="@PREFIX@/bin/qmail-rcptcheck" Index: pkgsrc/mail/qmail-run/files/qmailofmipd.sh diff -u pkgsrc/mail/qmail-run/files/qmailofmipd.sh:1.14 pkgsrc/mail/qmail-run/files/qmailofmipd.sh:1.15 --- pkgsrc/mail/qmail-run/files/qmailofmipd.sh:1.14 Sat Nov 3 17:08:26 2018 +++ pkgsrc/mail/qmail-run/files/qmailofmipd.sh Thu Nov 8 20:57:28 2018 @@ -1,6 +1,6 @@ #!@RCD_SCRIPTS_SHELL@ # -# $NetBSD: qmailofmipd.sh,v 1.14 2018/11/03 17:08:26 schmonz Exp $ +# $NetBSD: qmailofmipd.sh,v 1.15 2018/11/08 20:57:28 schmonz Exp $ # # @PKGNAME@ script to control ofmipd (SMTP submission service). # @@ -11,7 +11,7 @@ name="qmailofmipd" # User-settable rc.conf variables and their default values: -: ${qmailofmipd_postenv:="SSL_UID=$(@ID@ -u @UCSPI_SSL_USER@) SSL_GID=$(@ID@ -g @UCSPI_SSL_GROUP@) DHFILE=@PKG_SYSCONFDIR@/control/dh2048.pem CERTFILE=@PKG_SYSCONFDIR@/control/servercert.pem"} +: ${qmailofmipd_postenv:="SSL_UID=$(@ID@ -u @UCSPI_SSL_USER@) SSL_GID=$(@ID@ -g @UCSPI_SSL_GROUP@)"} : ${qmailofmipd_tcpflags:="-ne -vRl0"} : ${qmailofmipd_tcphost:="0.0.0.0"} : ${qmailofmipd_tcpport:="587"} @@ -25,15 +25,16 @@ name="qmailofmipd" : ${qmailofmipd_log:="YES"} : ${qmailofmipd_logcmd:="logger -t nbqmail/ofmipd -p mail.info"} : ${qmailofmipd_nologcmd:="@PREFIX@/bin/multilog -*"} +: ${qmailofmipd_tls:="auto"} +: ${qmailofmipd_tls_dhparams:="@PKG_SYSCONFDIR@/control/dh2048.pem"} +: ${qmailofmipd_tls_cert:="@PKG_SYSCONFDIR@/control/servercert.pem"} if [ -f /etc/rc.subr ]; then . /etc/rc.subr fi rcvar=${name} -required_files="@PKG_SYSCONFDIR@/control/dh2048.pem" -required_files="${required_files} @PKG_SYSCONFDIR@/control/servercert.pem" -required_files="${required_files} @PKG_SYSCONFDIR@/control/me" +required_files="@PKG_SYSCONFDIR@/control/me" required_files="${required_files} @PKG_SYSCONFDIR@/control/concurrencysubmission" required_files="${required_files} @PKG_SYSCONFDIR@/control/rcpthosts" required_files="${required_files} @PKG_SYSCONFDIR@/control/smtpcapabilities" @@ -49,11 +50,35 @@ cont_cmd="qmailofmipd_cont" cdb_cmd="qmailofmipd_cdb" reload_cmd=${cdb_cmd} +qmailofmipd_configure_tls() { + if [ "auto" = "${qmailofmipd_tls}" ]; then + if [ -f "${qmailofmipd_tls_dhparams}" ] && [ -f "${qmailofmipd_tls_cert}" ]; then + qmailofmipd_enable_tls + else + qmailofmipd_disable_tls + fi + elif [ -f /etc/rc.subr ] && checkyesno qmailofmipd_tls; then + qmailofmipd_enable_tls + else + qmailofmipd_disable_tls + fi +} + +qmailofmipd_disable_tls() { + qmailofmipd_postenv="${qmailofmipd_postenv} DISABLETLS=1" +} + +qmailofmipd_enable_tls() { + qmailofmipd_postenv="${qmailofmipd_postenv} DHFILE=${qmailofmipd_tls_dhparams}" + qmailofmipd_postenv="${qmailofmipd_postenv} CERTFILE=${qmailofmipd_tls_cert}" +} + qmailofmipd_precmd() { if [ -f /etc/rc.subr ] && ! checkyesno qmailofmipd_log; then qmailofmipd_logcmd=${qmailofmipd_nologcmd} fi + qmailofmipd_configure_tls # tcpserver(1) is akin to inetd(8), but runs one service per process. # We want to signal only the tcpserver process responsible for this # service. Use argv0(1) to set procname to "nbqmailofmipd". Index: pkgsrc/mail/qmail-run/files/qmailpop3d.sh diff -u pkgsrc/mail/qmail-run/files/qmailpop3d.sh:1.23 pkgsrc/mail/qmail-run/files/qmailpop3d.sh:1.24 --- pkgsrc/mail/qmail-run/files/qmailpop3d.sh:1.23 Sat Nov 3 17:08:26 2018 +++ pkgsrc/mail/qmail-run/files/qmailpop3d.sh Thu Nov 8 20:57:28 2018 @@ -1,6 +1,6 @@ #!@RCD_SCRIPTS_SHELL@ # -# $NetBSD: qmailpop3d.sh,v 1.23 2018/11/03 17:08:26 schmonz Exp $ +# $NetBSD: qmailpop3d.sh,v 1.24 2018/11/08 20:57:28 schmonz Exp $ # # @PKGNAME@ script to control qmail-pop3d (POP3 server for Maildirs). # @@ -10,7 +10,7 @@ name="qmailpop3d" # User-settable rc.conf variables and their default values: -: ${qmailpop3d_postenv:="SSL_UID=$(@ID@ -u @UCSPI_SSL_USER@) SSL_GID=$(@ID@ -g @UCSPI_SSL_GROUP@) DHFILE=@PKG_SYSCONFDIR@/control/dh2048.pem CERTFILE=@PKG_SYSCONFDIR@/control/servercert.pem"} +: ${qmailpop3d_postenv:="SSL_UID=$(@ID@ -u @UCSPI_SSL_USER@) SSL_GID=$(@ID@ -g @UCSPI_SSL_GROUP@)"} : ${qmailpop3d_tcpflags:="-ne -vRl0"} : ${qmailpop3d_tcphost:="0.0.0.0"} : ${qmailpop3d_tcpport:="110"} @@ -24,15 +24,16 @@ name="qmailpop3d" : ${qmailpop3d_log:="YES"} : ${qmailpop3d_logcmd:="logger -t nbqmail/pop3d -p mail.info"} : ${qmailpop3d_nologcmd:="@PREFIX@/bin/multilog -*"} +: ${qmailpop3d_tls:="auto"} +: ${qmailpop3pd_tls_dhparams:="@PKG_SYSCONFDIR@/control/dh2048.pem"} +: ${qmailpop3pd_tls_cert:="@PKG_SYSCONFDIR@/control/servercert.pem"} if [ -f /etc/rc.subr ]; then . /etc/rc.subr fi rcvar=${name} -required_files="@PKG_SYSCONFDIR@/control/dh2048.pem" -required_files="${required_files} @PKG_SYSCONFDIR@/control/servercert.pem" -required_files="${required_files} @PKG_SYSCONFDIR@/control/me" +required_files="@PKG_SYSCONFDIR@/control/me" required_files="${required_files} @PKG_SYSCONFDIR@/control/concurrencypop3" required_files="${required_files} @PKG_SYSCONFDIR@/control/pop3capabilities" required_files="${required_files} @PKG_SYSCONFDIR@/tcp.pop3.cdb" @@ -46,11 +47,35 @@ cont_cmd="qmailpop3d_cont" cdb_cmd="qmailpop3d_cdb" reload_cmd=${cdb_cmd} +qmailpop3d_configure_tls() { + if [ "auto" = "${qmailpop3d_tls}" ]; then + if [ -f "${qmailpop3d_tls_dhparams}" ] && [ -f "${qmailpop3d_tls_cert}" ]; then + qmailpop3d_enable_tls + else + qmailpop3d_disable_tls + fi + elif [ -f /etc/rc.subr ] && checkyesno qmailpop3d_tls; then + qmailpop3d_enable_tls + else + qmailpop3d_disable_tls + fi +} + +qmailpop3d_disable_tls() { + qmailpop3d_postenv="${qmailpop3d_postenv} DISABLETLS=1" +} + +qmailpop3d_enable_tls() { + qmailpop3d_postenv="${qmailpop3d_postenv} DHFILE=${qmailpop3d_tls_dhparams}" + qmailpop3d_postenv="${qmailpop3d_postenv} CERTFILE=${qmailpop3d_tls_cert}" +} + qmailpop3d_precmd() { if [ -f /etc/rc.subr ] && ! checkyesno qmailpop3d_log; then qmailpop3d_logcmd=${qmailpop3d_nologcmd} fi + qmailpop3d_configure_tls # tcpserver(1) is akin to inetd(8), but runs one service per process. # We want to signal only the tcpserver process responsible for this # service. Use argv0(1) to set procname to "nbqmailpop3d". Index: pkgsrc/mail/qmail-run/files/qmailsmtpd.sh diff -u pkgsrc/mail/qmail-run/files/qmailsmtpd.sh:1.19 pkgsrc/mail/qmail-run/files/qmailsmtpd.sh:1.20 --- pkgsrc/mail/qmail-run/files/qmailsmtpd.sh:1.19 Sat Nov 3 17:08:26 2018 +++ pkgsrc/mail/qmail-run/files/qmailsmtpd.sh Thu Nov 8 20:57:28 2018 @@ -1,6 +1,6 @@ #!@RCD_SCRIPTS_SHELL@ # -# $NetBSD: qmailsmtpd.sh,v 1.19 2018/11/03 17:08:26 schmonz Exp $ +# $NetBSD: qmailsmtpd.sh,v 1.20 2018/11/08 20:57:28 schmonz Exp $ # # @PKGNAME@ script to control qmail-smtpd (SMTP service). # @@ -11,28 +11,32 @@ name="qmailsmtpd" # User-settable rc.conf variables and their default values: -: ${qmailsmtpd_postenv:=""} -: ${qmailsmtpd_tcpflags:="-vRl0"} -: ${qmailsmtpd_tcphost:="0"} +: ${qmailsmtpd_postenv:="SSL_UID=$(@ID@ -u @UCSPI_SSL_USER@) SSL_GID=$(@ID@ -g @UCSPI_SSL_GROUP@)"} +: ${qmailsmtpd_tcpflags:="-ne -vRl0"} +: ${qmailsmtpd_tcphost:="0.0.0.0"} : ${qmailsmtpd_tcpport:="25"} -: ${qmailsmtpd_datalimit:="180000000"} +: ${qmailsmtpd_datalimit:="360000000"} : ${qmailsmtpd_pretcpserver:=""} -: ${qmailsmtpd_tcpserver:="@PREFIX@/bin/tcpserver"} -: ${qmailsmtpd_presmtpd:=""} +: ${qmailsmtpd_tcpserver:="@PREFIX@/bin/sslserver"} +: ${qmailsmtpd_presmtpd:="@PREFIX@/bin/greetdelay @PREFIX@/bin/rblsmtpd -r zen.spamhaus.org @PREFIX@/bin/fixsmtpio"} : ${qmailsmtpd_smtpdcmd:="@PREFIX@/bin/qmail-smtpd"} : ${qmailsmtpd_postsmtpd:=""} : ${qmailsmtpd_log:="YES"} : ${qmailsmtpd_logcmd:="logger -t nbqmail/smtpd -p mail.info"} : ${qmailsmtpd_nologcmd:="@PREFIX@/bin/multilog -*"} +: ${qmailsmtpd_tls:="auto"} +: ${qmailsmtpd_tls_dhparams:="@PKG_SYSCONFDIR@/control/dh2048.pem"} +: ${qmailsmtpd_tls_cert:="@PKG_SYSCONFDIR@/control/servercert.pem"} if [ -f /etc/rc.subr ]; then . /etc/rc.subr fi rcvar=${name} -required_files="@PKG_SYSCONFDIR@/control/concurrencyincoming" -required_files="${required_files} @PKG_SYSCONFDIR@/tcp.smtp.cdb" +required_files="@PKG_SYSCONFDIR@/control/me" +required_files="${required_files} @PKG_SYSCONFDIR@/control/concurrencyincoming" required_files="${required_files} @PKG_SYSCONFDIR@/control/rcpthosts" +required_files="${required_files} @PKG_SYSCONFDIR@/tcp.smtp.cdb" command="${qmailsmtpd_tcpserver}" procname=nb${name} start_precmd="qmailsmtpd_precmd" @@ -43,11 +47,35 @@ cont_cmd="qmailsmtpd_cont" cdb_cmd="qmailsmtpd_cdb" reload_cmd=${cdb_cmd} +qmailsmtpd_configure_tls() { + if [ "auto" = "${qmailsmtpd_tls}" ]; then + if [ -f "${qmailsmtpd_tls_dhparams}" ] && [ -f "${qmailsmtpd_tls_cert}" ]; then + qmailsmtpd_enable_tls + else + qmailsmtpd_disable_tls + fi + elif [ -f /etc/rc.subr ] && checkyesno qmailsmtpd_tls; then + qmailsmtpd_enable_tls + else + qmailsmtpd_disable_tls + fi +} + +qmailsmtpd_disable_tls() { + qmailsmtpd_postenv="${qmailsmtpd_postenv} DISABLETLS=1" +} + +qmailsmtpd_enable_tls() { + qmailsmtpd_postenv="${qmailsmtpd_postenv} DHFILE=${qmailsmtpd_tls_dhparams}" + qmailsmtpd_postenv="${qmailsmtpd_postenv} CERTFILE=${qmailsmtpd_tls_cert}" +} + qmailsmtpd_precmd() { if [ -f /etc/rc.subr ] && ! checkyesno qmailsmtpd_log; then qmailsmtpd_logcmd=${qmailsmtpd_nologcmd} fi + qmailsmtpd_configure_tls # tcpserver(1) is akin to inetd(8), but runs one service per process. # We want to signal only the tcpserver process responsible for this # service. Use argv0(1) to set procname to "nbqmailsmtpd". Index: pkgsrc/mail/qmail-run/files/tcp.ofmip diff -u pkgsrc/mail/qmail-run/files/tcp.ofmip:1.3 pkgsrc/mail/qmail-run/files/tcp.ofmip:1.4 --- pkgsrc/mail/qmail-run/files/tcp.ofmip:1.3 Sun Oct 28 15:01:57 2018 +++ pkgsrc/mail/qmail-run/files/tcp.ofmip Thu Nov 8 20:57:28 2018 @@ -1 +1 @@ -:allow,QMAILQUEUE="@PREFIX@/bin/qmail-qfilter-ofmipd-queue",UCSPITLS="!",PYMSGAUTH_TOLERATE_UNCONFIGURED="1" +:allow,UCSPITLS="!",QMAILQUEUE="@PREFIX@/bin/qmail-qfilter-ofmipd-queue",PYMSGAUTH_TOLERATE_UNCONFIGURED="1" --_----------=_154171064881510--