update postsrsd to version 1.11

The update fixes CVE-2020-35573 and CVE-2021-35525


(spz)

===========================================================================
$NetBSD: MESSAGE,v 1.1 2021/07/10 08:41:56 spz Exp $

When using postsrsd with its rc.d script, at the minimum set
postsrsd_flags="-dyour.domain"
in rc.conf. See the manpage for more options.

You must store at least one secret key in ${PKG_SYSCONFDIR}/postsrsd.secret.
Be careful that no one can guess your secret, because anyone who knows it
can use your mail server as open relay.
Each line of ${PKG_SYSCONFDIR}/postsrsd.secret is used as secret.
The first secret is used for signing and verification, the others for
verification only.

PostSRSd exposes its functionality via two TCP lookup tables.
Add or amend the following variables in your main.cf:

    sender_canonical_maps = tcp:localhost:10001
    sender_canonical_classes = envelope_sender
    recipient_canonical_maps = tcp:localhost:10002
    recipient_canonical_classes= envelope_recipient,header_recipient

This will transparently rewrite incoming and outgoing envelope addresses,
and additionally undo SRS rewrites in the To: header of bounce notifications
and vacation autoreplies.

===========================================================================

#!@RCD_SCRIPTS_SHELL@
#
# PostSRSd provides the Sender Rewriting Scheme (SRS) for Postfix
#

# PROVIDE: postsrsd
# BEFORE: mail
# REQUIRE: DAEMON LOGIN

. /etc/rc.subr

name="postsrsd"

# user-settable rc.conf variables
: ${postsrsd_secret:="@PKG_SYSCONFDIR@/${name}.secret"}
: ${postsrsd_chrootdir:="@VARBASE@/chroot/postsrsd"}

rcvar=${name}
required_files="${postsrsd_secret}"
pidfile="@VARBASE@/run/${name}.pid"
command="@PREFIX@/sbin/${name}"
start_precmd="postsrsd_precmd"

postsrsd_precmd()
{
	rc_flags="-p${pidfile} -s${postsrsd_secret} -D $rc_flags"
	if [ -z "$postsrsd_chrootdir" ]; then
		return 0;
	fi

	# If running in a chroot cage, ensure that the appropriate files
	# exist inside the cage, as well as helper symlinks into the cage 
	# from outside.
	if [ ! -d "${postsrsd_chrootdir}" ]; then
		mkdir -p "${postsrsd_chrootdir}"
	fi

	#	Change run_rc_commands()'s internal copy of $ntpd_flags
	#
	rc_flags="-upostsrsd -c${postsrsd_chrootdir} $rc_flags"
}

load_rc_config $name
run_rc_command "$1"

$NetBSD: patch-postsrsd.c,v 1.1 2021/07/10 08:41:56 spz Exp $

make sure we can use a connection more than once
it'll work without the patch but with many error messages in the log

--- postsrsd.c.orig	2021-03-21 19:23:39.000000000 +0000
+++ postsrsd.c	2021-07-09 10:29:40.996255562 +0000
@@ -644,7 +644,7 @@
     }
     while (TRUE)
     {
-        int conn;
+        int conn, flags;
         FILE *fp_read, *fp_write;
         char linebuf[1024], *line;
         char keybuf[1024], *key;
@@ -667,6 +667,16 @@
                 conn = accept(fds[sc].fd, NULL, NULL);
                 if (conn < 0)
                     continue;
+                /* remove the nonblocking for !Linux */
+                flags = fcntl(conn, F_GETFL, 0);
+                if (flags < 0) {
+                    close(conn);
+                    continue;
+                }
+                if (fcntl(conn, F_SETFL, flags & ~O_NONBLOCK) < 0) {
+                    close(conn);
+                    continue;
+                }
                 if (fork() == 0)
                 {
                     int i;