[pkgsrc/trunk]: pkgsrc/mail/postfix postfix: Update to 3.5.9

[triaxx <triaxx%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/4344d8ab55bd
branches:  trunk
changeset: 445355:4344d8ab55bd
user:      triaxx <triaxx%pkgsrc.org@localhost>
date:      Thu Jan 21 16:37:59 2021 +0000

description:
postfix: Update to 3.5.9

upstream changes:
-----------------
This update improves the reporting of DNSSEC problems that may affect DANE
security. DNSSEC support may unavailable because of local configuration, libc
incompatibility, or other infrastructure issues. This was backported from
Postfix 3.6.

Background: DNSSEC validation is needed for Postfix DANE support; this ensures
that Postfix receives TLSA records with secure TLS server certificate info.
When DNSSEC validation is unavailable, mail deliveries using opportunistic DANE
(security level 'dane') will not be protected by server certificate info in
TLSA records, and mail deliveries using mandatory DANE (security level
'dane-only') will not be made at all.

This update introduces the following behavior: when a process requests DNSSEC
support (typically, for Postfix DANE support), the process may now do a runtime
test to determine if DNSSEC validation is available.

The new dnssec_probe parameter specifies a DNS query type (default: "ns") and
DNS query name (default: ".") that Postfix may use to determine whether DNSSEC
validation is available. Specify an empty value to disable this feature.

When dnssec_probe is enabled, a Postfix process will send a DNSSEC probe after
1) the process made a DNS query that requested DNSSEC validation, 2) the
process did not receive a DNSSEC validated response to this query or to an
earlier query, and 3) the process did not already send a DNSSEC probe.

When the DNSSEC probe has no response, or when the response is not DNSSEC
validated, Postfix logs a warning that DNSSEC validation may be unavailable.
Examples:

warning: DNSSEC validation may be unavailable
warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated
warning: reason: dnssec_probe 'ns:.' received no response: Server failure

With this update, the Postfix build system will no longer automatically disable
DNSSEC support when it determines that Postfix will use libc-musl. This removes
the earlier libc-musl workaround introduced with Postfix 3.2.15, 3.3.10,
3.4.12, and 3.5.2.

diffstat:

 mail/postfix/Makefile.common                     |   4 +-
 mail/postfix/distinfo                            |  12 ++++----
 mail/postfix/patches/patch-src_dns_dns__lookup.c |  29 ++++++++++-------------
 3 files changed, 21 insertions(+), 24 deletions(-)

diffs (134 lines):

diff -r 1960c268258c -r 4344d8ab55bd mail/postfix/Makefile.common
--- a/mail/postfix/Makefile.common      Thu Jan 21 15:39:33 2021 +0000
+++ b/mail/postfix/Makefile.common      Thu Jan 21 16:37:59 2021 +0000
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile.common,v 1.31 2020/11/22 11:14:44 adam Exp $
+# $NetBSD: Makefile.common,v 1.32 2021/01/21 16:37:59 triaxx Exp $
 # used by mail/postfix/Makefile
 # used by mail/postfix/Makefile.module
 
-DISTNAME=      postfix-3.5.8
+DISTNAME=      postfix-3.5.9
 CATEGORIES=    mail
 MASTER_SITES=  ftp://ftp.porcupine.org/mirrors/postfix-release/official/
 MASTER_SITES+= http://mirrors.isc.org/pub/postfix/official/
diff -r 1960c268258c -r 4344d8ab55bd mail/postfix/distinfo
--- a/mail/postfix/distinfo     Thu Jan 21 15:39:33 2021 +0000
+++ b/mail/postfix/distinfo     Thu Jan 21 16:37:59 2021 +0000
@@ -1,10 +1,10 @@
-$NetBSD: distinfo,v 1.190 2020/11/22 11:14:44 adam Exp $
+$NetBSD: distinfo,v 1.191 2021/01/21 16:37:59 triaxx Exp $
 
-SHA1 (postfix-3.5.8.tar.gz) = 1dfb10729498be5d387dc730117c2a845dd93ac0
-RMD160 (postfix-3.5.8.tar.gz) = 110351d43f0b1b8e5fa63d7f5d557fff5ece2b46
-SHA512 (postfix-3.5.8.tar.gz) = 0abb07d99e343b76e6a26b4a090af9d592f4dfd03c8c737cc72bfb0f4267dafcbb0cb0aa7b6255f8b834c9289d89a5c47b167be3758239309937cb77e0d9464b
-Size (postfix-3.5.8.tar.gz) = 4614733 bytes
+SHA1 (postfix-3.5.9.tar.gz) = f7caa483ebbb7f7b4f912dcfb879a5f1017c327e
+RMD160 (postfix-3.5.9.tar.gz) = 7df8bcf324ab6604ab1a6ba2f47eadeeebd1c65e
+SHA512 (postfix-3.5.9.tar.gz) = 9ff3a33cdd5811e470d5c6cfa896fa76e4d3257b139deec5f420d18e34232f327b7c8496c5d13566c6f9ae1fdf8719feb9981372b2869b0208a2eb3a1daaeadd
+Size (postfix-3.5.9.tar.gz) = 4620852 bytes
 SHA1 (patch-aa) = c8216f133e202a7bb37682b0dbc1448f021e7c1c
 SHA1 (patch-ag) = c126c572e36bf2bcbd3f6e5d8332a3d26e704109
 SHA1 (patch-ai) = 51748ccf92da543f7ff640f36906a29b5db3f6e3
-SHA1 (patch-src_dns_dns__lookup.c) = 036872a0e6e438d0253469ea447c0c9c1de0188d
+SHA1 (patch-src_dns_dns__lookup.c) = 1e3fbd8e8b900e3fbd7160344c150bf147e4490a
diff -r 1960c268258c -r 4344d8ab55bd mail/postfix/patches/patch-src_dns_dns__lookup.c
--- a/mail/postfix/patches/patch-src_dns_dns__lookup.c  Thu Jan 21 15:39:33 2021 +0000
+++ b/mail/postfix/patches/patch-src_dns_dns__lookup.c  Thu Jan 21 16:37:59 2021 +0000
@@ -1,10 +1,10 @@
-$NetBSD: patch-src_dns_dns__lookup.c,v 1.7 2020/04/26 09:33:26 taca Exp $
+$NetBSD: patch-src_dns_dns__lookup.c,v 1.8 2021/01/21 16:37:59 triaxx Exp $
 
 Fix runtime problem when mysql PKG_OPTIONS is enabled.
 
---- src/dns/dns_lookup.c.orig  2019-12-15 16:19:34.000000000 +0000
+--- src/dns/dns_lookup.c.orig  2021-01-16 16:24:08.000000000 +0000
 +++ src/dns/dns_lookup.c
-@@ -247,6 +247,8 @@
+@@ -256,6 +256,8 @@
  
  /* Local stuff. */
  
@@ -13,7 +13,7 @@
   /*
    * Structure to keep track of things while decoding a name server reply.
    */
-@@ -311,7 +313,7 @@ typedef struct DNS_REPLY {
+@@ -320,7 +322,7 @@ typedef struct DNS_REPLY {
  
  /* dns_res_query - a res_query() clone that can return negative replies */
  
@@ -22,7 +22,7 @@
                                 unsigned char *answer, int anslen)
  {
      unsigned char msg_buf[MAX_DNS_QUERY_SIZE];
-@@ -340,14 +342,14 @@ static int dns_res_query(const char *nam
+@@ -349,14 +351,14 @@ static int dns_res_query(const char *nam
  #define NO_MKQUERY_DATA_LEN     ((int) 0)
  #define NO_MKQUERY_NEWRR        ((unsigned char *) 0)
  
@@ -39,7 +39,7 @@
        SET_H_ERRNO(TRY_AGAIN);
        if (msg_verbose)
            msg_info("res_send() failed");
-@@ -378,7 +380,7 @@ static int dns_res_query(const char *nam
+@@ -387,7 +389,7 @@ static int dns_res_query(const char *nam
  
  /* dns_res_search - res_search() that can return negative replies */
  
@@ -48,7 +48,7 @@
                       unsigned char *answer, int anslen, int keep_notfound)
  {
      int     len;
-@@ -401,7 +403,7 @@ static int dns_res_search(const char *na
+@@ -410,7 +412,7 @@ static int dns_res_search(const char *na
      if (keep_notfound)
        /* Prepare for returning a null-padded server reply. */
        memset(answer, 0, anslen);
@@ -57,7 +57,7 @@
      /* Begin API creep workaround. */
      if (len < 0 && h_errno == 0) {
        SET_H_ERRNO(TRY_AGAIN);
-@@ -440,7 +442,7 @@ static int dns_query(const char *name, i
+@@ -449,7 +451,7 @@ static int dns_query(const char *name, i
      /*
       * Initialize the name service.
       */
@@ -66,7 +66,7 @@
        if (why)
            vstring_strcpy(why, "Name service initialization failure");
        return (DNS_FAIL);
-@@ -479,32 +481,32 @@ static int dns_query(const char *name, i
+@@ -488,18 +490,18 @@ static int dns_query(const char *name, i
       */
  #define SAVE_FLAGS (USER_FLAGS | XTRA_FLAGS)
  
@@ -85,19 +85,16 @@
        if (keep_notfound && var_dns_ncache_ttl_fix) {
  #ifdef HAVE_RES_SEND
 -          len = dns_res_query((char *) name, C_IN, type, reply->buf,
-+              len = dns_res_query(&rstate, (char *) name, C_IN, type, reply->buf,
++      len = dns_res_query(&rstate, (char *) name, C_IN, type, reply->buf,
                                reply->buf_len);
  #else
            var_dns_ncache_ttl_fix = 0;
-           msg_warn("system library does not support %s=yes"
-                    " -- ignoring this setting", VAR_DNS_NCACHE_TTL_FIX);
--          len = dns_res_search((char *) name, C_IN, type, reply->buf,
-+          len = dns_res_search(&rstate, (char *) name, C_IN, type, reply->buf,
+@@ -509,11 +511,11 @@ static int dns_query(const char *name, i
                                 reply->buf_len, keep_notfound);
  #endif
        } else {
 -          len = dns_res_search((char *) name, C_IN, type, reply->buf,
-+              len = dns_res_search(&rstate, (char *) name, C_IN, type, reply->buf,
++          len = dns_res_search(&rstate, (char *) name, C_IN, type, reply->buf,
                                 reply->buf_len, keep_notfound);
        }
 -      _res.options &= ~flags;
@@ -106,4 +103,4 @@
 +      rstate.options |= saved_options;
        reply_header = (HEADER *) reply->buf;
        reply->rcode = reply_header->rcode;
-       if (h_errno != 0) {
+       if ((reply->dnssec_ad = !!reply_header->ad) != 0)