Merge ~lucaskanashiro/ubuntu/+source/postfix:update-to-version-3.4.13 into ubuntu/+source/postfix:ubuntu/focal-devel

[Lucas Kanashiro]

Import microrelease version 3.4.13 to Focal. It will fix LP #1868955 and #1881196.

Here is a PPA with the proposed package:

https://launchpad.net/~lucaskanashiro/+archive/ubuntu/focal-postfix

autopkgtest is still happy:

autopkgtest [14:47:23]: @@@@@@@@@@@@@@@@@@@@ summary
postfix PASS

[Christian Ehrhardt  (paelzer)]

Changes look all SRUable to me.
Changelog is correct as Focal+1 already has 3.5 we don't need to be too careful on version collisions.

bug 1881196 misses an SRU template, so before you upload add something there please.

the sru template in 1868955 described 3.4.13 but since we jump 3.4.10->3.4.13 you might want to rephrase a few things like "According to upstream there are just 2 changes in this new microrelease ..." if you look at the diff to the HISTORY file you see what might be worth to mention as "being ok for this MRE SRU".

All that I found to adapt is work on bug descriptions, the MP itself LGTM

review: Approve

[Lucas Kanashiro (lucaskanashiro)]

Thanks Christian! I updated the bugs description and already uploaded the package:

$ git push pkg upload/3.4.13-0ubuntu1
Enumerating objects: 104, done.
Counting objects: 100% (104/104), done.
Delta compression using up to 8 threads
Compressing objects: 100% (47/47), done.
Writing objects: 100% (56/56), 8.29 KiB | 530.00 KiB/s, done.
Total 56 (delta 52), reused 9 (delta 9)
remote: Checking connectivity: 56, done.
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/postfix
 * [new tag] upload/3.4.13-0ubuntu1 -> upload/3.4.13-0ubuntu1

$ dput ubuntu ../postfix_3.4.13-0ubuntu1_source.changes
Checking signature on .changes
gpg: ../postfix_3.4.13-0ubuntu1_source.changes: Valid signature from F823A2729883C97C
Checking signature on .dsc
gpg: ../postfix_3.4.13-0ubuntu1.dsc: Valid signature from F823A2729883C97C
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading postfix_3.4.13-0ubuntu1.dsc: done.
  Uploading postfix_3.4.13.orig.tar.gz: done.
  Uploading postfix_3.4.13.orig.tar.gz.asc: done.
  Uploading postfix_3.4.13-0ubuntu1.debian.tar.xz: done.
  Uploading postfix_3.4.13-0ubuntu1_source.changes: done.
Successfully uploaded packages.

diff --git a/HISTORY b/HISTORY
index 1ebf42a..fe15290 100644
--- a/HISTORY
+++ b/HISTORY
@@ -24346,3 +24346,84 @@ Apologies for any names omitted.
 	multi-Milter configuration during MAIL FROM. Milter client
 	state was not properly reset after one of the Milters failed.
 	Reported by WeiYu Wu.
+
[phone]
+
+	Workaround for broken builds after an incompatible change
+	in GCC 10. Files: makedefs, Makefile.in.
+
+	Workaround for broken DANE support after an incompatible
+	change in GLIBC 2.31. This avoids the need for new options
+	in /etc/resolv.conf. Files: dns/dns.h, dns/dns_lookup.c.
+
[phone]
+
+	Bugfix: segfault in the tlsproxy client role when the server
+	role was disabled. This typically happens on systems that
+	do not receive mail, after configuring connection reuse for
+	outbound TLS. Found during program maintenance. File:
+	tlsproxy/tlsproxy.c.
+
[phone]
+
+	Noise suppression: shut up a compiler that special-cases
+	string literals. Viktor Dukhovni. File milter/milter.c.
+
[phone]
+
+	Security: disable DANE support on Alpine Linux because
+	libc-musl provides no indication whether DNS responses are
+	authentic. This broke DANE support without a clear explanation.
+	File: makedefs.
+
[phone]
+
+	Noise suppression: shut up a compiler that special-cases
+	string literals. Viktor Dukhovni. File smtpd/smtpd_check.c.
+
[phone]
+
+	Bugfix (introduced: Postfix 3.5): maillog_file_rotate_suffix
+	default value used the minute instead of the month. Reported
+	by Larry Stone. Files: conf/postfix-tls-script,
+	proto/MAILLOG_README.html, proto/postconf.proto.
+	global/mail_params.h, postfix/postfix.c.
+
[phone]
+
+	Bitrot: avoid U_FILE_ACCESS_ERROR after chroot(), by
+	initializing the ICU library before making the chroot()
+	call. Files: util/midna_domain.[hc], global/mail_params.c.
+
[phone]
+
+	Noise suppression: avoid "SSL_Shutdown:shutdown while in
+	init" warnings. File: tls/tls_session.c.
+
[phone]
+
+	Bugfix (introduced: Postfix 2.2): a TLS error for a PostgreSQL
+	client caused a false 'lost connection' error for an SMTP
+	over TLS session in the same Postfix process. Reported by
+	Alexander Vasarab, diagnosed by Viktor Dukhovni. File:
+	tls/tls_bio_ops.c.
+
+	Bugfix (introduced: Postfix 2.8): a TLS error for one TLS
+	session may cause a false 'lost connection' error for a
+	concurrent TLS session in the same tlsproxy process. File:
+	tlsproxy/tlsproxy.c.
+
[phone]
+
+	Bugfix (introduced: Postfix 3.1): "postfix tls deploy-server-cert"
+	did not handle a missing optional argument. File:
+	conf/postfix-tls-script.
+
[phone]
+
+	Bugfix (introduced: Postfix 3.4): in the Postfix SMTP server,
+	the SNI callback reported an error when it was called a
+	second time. This happened after the server-side TLS engine
+	sent a TLSv1.3 HelloRetryRequest (HRR) to a remote SMTP
+	client. Reported by Ján Máté, fixed by Viktor Dukhovni.
+	File: tls/tls_misc.c.
diff --git a/Makefile.in b/Makefile.in
index fa12b04..aaab94d 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -1,5 +1,5 @@
 SHELL	= /bin/sh
-WARN    = -Wmissing-prototypes -Wformat -Wno-comment
+WARN    = -Wmissing-prototypes -Wformat -Wno-comment -fcommon
 OPTS	= 'WARN=$(WARN)'
 DIRS	= src/util src/global src/dns src/tls src/xsasl src/master src/milter \
 	src/postfix src/fsstone src/smtpstone \
diff --git a/README_FILES/MAILLOG_README b/README_FILES/MAILLOG_README
index 5184425..cc8b097 100644
--- a/README_FILES/MAILLOG_README
+++ b/README_FILES/MAILLOG_README
@@ -64,7 +64,7 @@ implements the following steps:
 
   * Rename the current logfile by appending a suffix that contains the date and
     time. This suffix is configured with the maillog_file_rotate_suffix
-    parameter (default: %Y%M%d-%H%M%S).
+    parameter (default: %Y%m%d-%H%M%S).
 
   * Reload Postfix so that postlogd(8) immediately closes the old logfile.
 
diff --git a/RELEASE_NOTES b/RELEASE_NOTES
index 63e8e5a..c981244 100644
--- a/RELEASE_NOTES
+++ b/RELEASE_NOTES
@@ -16,6 +16,14 @@ specifies the release date of a stable release or snapshot release.
 If you upgrade from Postfix 3.2 or earlier, read RELEASE_NOTES-3.3
 before proceeding.
 
+libc-musl workaround for Postfix 3.2.15, 3.3.10, 3.4.12, and 3.5.2
+------------------------------------------------------------------
+
+Security: this release disables DANE support on Linux systems with
+libc-musl, because libc-musl provides no indication whether DNS
+responses are authentic. This broke DANE support without a clear
+explanation.
+
 TLS Workaround for Postfix 3.4.6, 3.3.5, 3.2.10 and 3.1.13
 -----------------------------------------------------------
 
diff --git a/conf/postfix-tls-script b/conf/postfix-tls-script
index 2c3430a..1a364b7 100644
--- a/conf/postfix-tls-script
+++ b/conf/postfix-tls-script
@@ -777,7 +777,7 @@ get_cache_db_type() {
 deploy_server_cert() {
     certfile=$1; shift
     keyfile=$1; shift
-    deploy=$1; shift
+    case $# in 0) deploy=;; *) deploy=$1; shift;; esac
 
     # Sets key_algo, key_param and cert_param
     check_key "$keyfile" || return 1
diff --git a/debian/changelog b/debian/changelog
index 86e71a2..ad23036 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+postfix (3.4.13-0ubuntu1) focal; urgency=medium
+
+  * New upstream release: 3.4.13
+    - Workaround for broken DANE support after an incompatible change in
+      GLIBC 2.31 (LP: #1868955)
+    - Fix "postfix tls deploy-server-cert", now it handles a missing optional
+      argument (LP: #1881196)
+  * Drop patch 80_glibc2.30-ftbfs.diff. This patch is not needed anymore and
+    it does not cleanly apply to this new upstream release.
+
+ -- Lucas Kanashiro <[e-mail]>  Fri, 19 Jun 2020 14:11:03 -0300
+
 postfix (3.4.10-1ubuntu1) focal; urgency=medium
 
   * d/configure-instance.sh: fix typo in tls_CApath copying (LP: #1872288)
diff --git a/debian/patches/80_glibc2.30-ftbfs.diff b/debian/patches/80_glibc2.30-ftbfs.diff
deleted file mode 100644
index c36baf0..0000000
--- a/debian/patches/80_glibc2.30-ftbfs.diff
+++ /dev/null
@@ -1,51 +0,0 @@
-Description: fix build with glibc 2.30
- glibc 2.30 release notes at
- https://savannah.gnu.org/forum/forum.php?forum_id=9515 states:
- """
- Support for the "inet6" option in /etc/resolv.conf and the RES_USE_INET6
- resolver flag (deprecated in glibc 2.25) have been removed.
- ...
- The obsolete RES_INSECURE1 and RES_INSECURE2 option flags for the DNS stub
- resolver have been removed from <resolv.h>.
- """
- And RES_AAONLY and RES_PRIMARY are already flagged as deprecated and are
- being guarded with the same fix.
-Origin: upstream, https://github.com/vdukhovni/postfix/commit/3274c3cea9d739f86e84b65664aabb692e37e83f#diff-777bfb681a1cd539ddc8e1e606959ffa
-Bug: http://postfix.1071664.n5.nabble.com/build-failure-with-glibc-2-30-td102511.html
-Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/postfix/+bug/1842923
-Last-Update: 2019-09-05
----
-This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
-diff --git a/postfix/src/dns/dns_str_resflags.c b/postfix/src/dns/dns_str_resflags.c
-index 5f2cce5e..472394c3 100644
---- a/src/dns/dns_str_resflags.c
-+++ b/src/dns/dns_str_resflags.c
-@@ -52,18 +52,28 @@
- static const LONG_NAME_MASK resflag_table[] = {
-     "RES_INIT", RES_INIT,
-     "RES_DEBUG", RES_DEBUG,
-+#ifdef RES_AAONLY
-     "RES_AAONLY", RES_AAONLY,
-+#endif
-     "RES_USEVC", RES_USEVC,
-+#ifdef RES_PRIMARY
-     "RES_PRIMARY", RES_PRIMARY,
-+#endif
-     "RES_IGNTC", RES_IGNTC,
-     "RES_RECURSE", RES_RECURSE,
-     "RES_DEFNAMES", RES_DEFNAMES,
-     "RES_STAYOPEN", RES_STAYOPEN,
-     "RES_DNSRCH", RES_DNSRCH,
-+#ifdef RES_INSECURE1
-     "RES_INSECURE1", RES_INSECURE1,
-+#endif
-+#ifdef RES_INSECURE2
-     "RES_INSECURE2", RES_INSECURE2,
-+#endif
-     "RES_NOALIASES", RES_NOALIASES,
-+#ifdef RES_USE_INET6
-     "RES_USE_INET6", RES_USE_INET6,
-+#endif
- #ifdef RES_ROTATE
-     "RES_ROTATE", RES_ROTATE,
- #endif
diff --git a/debian/patches/series b/debian/patches/series
index 4976a63..fe67e62 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -14,6 +14,5 @@
 41_rmail.diff
 50_LANG.diff
 70_postfix-check.diff
-80_glibc2.30-ftbfs.diff
 tls_version.diff
 debian-man-name.diff
diff --git a/html/MAILLOG_README.html b/html/MAILLOG_README.html
index b1f9702..c5b7978 100644
--- a/html/MAILLOG_README.html
+++ b/html/MAILLOG_README.html
@@ -114,7 +114,7 @@ run from a terminal. This command implements the following steps:
 
 <li> <p> Rename the current logfile by appending a suffix that
 contains the date and time. This suffix is configured with the
-<a href="postconf.5.html#maillog_file_rotate_suffix">maillog_file_rotate_suffix</a> parameter (default: %Y%M%d-%H%M%S). </p>
+<a href="postconf.5.html#maillog_file_rotate_suffix">maillog_file_rotate_suffix</a> parameter (default: %Y%m%d-%H%M%S). </p>
 
 <li> <p> Reload Postfix so that <a href="postlogd.8.html">postlogd(8)</a> immediately closes the
 old logfile. </p>
diff --git a/html/postconf.5.html b/html/postconf.5.html
index cba1fac..aa94c32 100644
--- a/html/postconf.5.html
+++ b/html/postconf.5.html
@@ -6284,7 +6284,7 @@ whitespace. </p>
 </DD>
 
 <DT><b><a name="maillog_file_rotate_suffix">maillog_file_rotate_suffix</a>
-(default: %Y%M%d-%H%M%S)</b></DT><DD>
+(default: %Y%m%d-%H%M%S)</b></DT><DD>
 
 <p> The format of the suffix to append to $<a href="postconf.5.html#maillog_file">maillog_file</a> while rotating
 the file with "postfix logrotate". See strftime(3) for syntax. The
diff --git a/html/postfix.1.html b/html/postfix.1.html
index 4c5c4f9..eb59ad3 100644
--- a/html/postfix.1.html
+++ b/html/postfix.1.html
@@ -285,7 +285,7 @@ POSTFIX(1)                                                          POSTFIX(1)
        <b><a href="postconf.5.html#maillog_file_prefixes">maillog_file_prefixes</a> (/var, /dev/stdout)</b>
               A list of allowed prefixes for a <a href="postconf.5.html#maillog_file">maillog_file</a> value.
 
-       <b><a href="postconf.5.html#maillog_file_rotate_suffix">maillog_file_rotate_suffix</a> (%Y%M%d-%H%M%S)</b>
+       <b><a href="postconf.5.html#maillog_file_rotate_suffix">maillog_file_rotate_suffix</a> (%Y%m%d-%H%M%S)</b>
               The format of the suffix to append to $<a href="postconf.5.html#maillog_file">maillog_file</a> while rotat-
               ing the file with "postfix logrotate".
 
diff --git a/makedefs b/makedefs
index 93731c2..64b42f4 100644
--- a/makedefs
+++ b/makedefs
@@ -228,6 +228,19 @@ case $# in
  *) echo usage: $0 [system release] 1>&2; exit 1;;
 esac
 
+case "$SYSTEM" in
+ Linux)
+    case "`PATH=/bin:/usr/bin ldd /bin/sh`" in
+     *-musl-*)
+	case "$CCARGS" in
+	 *-DNO_DNSSEC*) ;;
+	 *) echo Warning: libc-musl breaks DANE/TLSA security. 1>&2
+	    echo This build will not support DANE/TLSA. 1>&2
+	    CCARGS="$CCARGS -DNO_DNSSEC";;
+	esac;;
+    esac;;
+esac
+
 case "$SYSTEM.$RELEASE" in
    SCO_SV.3.2)	SYSTYPE=SCO5
 		# Use the native compiler by default
@@ -1136,7 +1149,7 @@ esac
 : ${CC=gcc} ${OPT='-O'} ${DEBUG='-g'} ${AWK=awk} \
 ${WARN='-Wall -Wno-comment -Wformat -Wimplicit -Wmissing-prototypes \
 	-Wparentheses -Wstrict-prototypes -Wswitch -Wuninitialized \
-	-Wunused -Wno-missing-braces'}
+	-Wunused -Wno-missing-braces -fcommon'}
 
 # Extract map type names from -DHAS_XXX compiler options.  We avoid
 # problems with tr(1) range syntax by using enumerations instead,
diff --git a/man/man1/postfix.1 b/man/man1/postfix.1
index 7a8a39c..412c0c9 100644
--- a/man/man1/postfix.1
+++ b/man/man1/postfix.1
@@ -252,7 +252,7 @@ The program to run after rotating $maillog_file with "postfix
 logrotate".
 .IP "\fBmaillog_file_prefixes (/var, /dev/stdout)\fR"
 A list of allowed prefixes for a maillog_file value.
-.IP "\fBmaillog_file_rotate_suffix (%Y%M%d\-%H%M%S)\fR"
+.IP "\fBmaillog_file_rotate_suffix (%Y%m%d\-%H%M%S)\fR"
 The format of the suffix to append to $maillog_file while rotating
 the file with "postfix logrotate".
 .IP "\fBpostlog_service_name (postlog)\fR"
diff --git a/man/man5/postconf.5 b/man/man5/postconf.5
index fdf6b39..ccb087a 100644
--- a/man/man5/postconf.5
+++ b/man/man5/postconf.5
@@ -3775,7 +3775,7 @@ mistake. Specify one or more prefix strings, separated by comma or
 whitespace.
 .PP
 This feature is available in Postfix 3.4 and later.
-.SH maillog_file_rotate_suffix (default: %Y%M%d\-%H%M%S)
+.SH maillog_file_rotate_suffix (default: %Y%m%d\-%H%M%S)
 The format of the suffix to append to $maillog_file while rotating
 the file with "postfix logrotate". See \fBstrftime\fR(3) for syntax. The
 default suffix, YYYYMMDD\-HHMMSS, allows logs to be rotated frequently.
diff --git a/proto/MAILLOG_README.html b/proto/MAILLOG_README.html
index 5fad103..9b56518 100644
--- a/proto/MAILLOG_README.html
+++ b/proto/MAILLOG_README.html
@@ -114,7 +114,7 @@ run from a terminal. This command implements the following steps:
 
 <li> <p> Rename the current logfile by appending a suffix that
 contains the date and time. This suffix is configured with the
-maillog_file_rotate_suffix parameter (default: %Y%M%d-%H%M%S). </p>
+maillog_file_rotate_suffix parameter (default: %Y%m%d-%H%M%S). </p>
 
 <li> <p> Reload Postfix so that postlogd(8) immediately closes the
 old logfile. </p>
diff --git a/proto/postconf.proto b/proto/postconf.proto
index f29cdf6..a37fb01 100644
--- a/proto/postconf.proto
+++ b/proto/postconf.proto
@@ -17611,7 +17611,7 @@ first argument. </p>
 
 <p> This feature is available in Postfix 3.4 and later. </p>
 
-%PARAM maillog_file_rotate_suffix %Y%M%d-%H%M%S
+%PARAM maillog_file_rotate_suffix %Y%m%d-%H%M%S
 
 <p> The format of the suffix to append to $maillog_file while rotating
 the file with "postfix logrotate". See strftime(3) for syntax. The
diff --git a/src/dns/dns.h b/src/dns/dns.h
index f758e44..b8c4c4a 100644
--- a/src/dns/dns.h
+++ b/src/dns/dns.h
@@ -59,6 +59,7 @@
  */
 #ifdef NO_DNSSEC
 #undef RES_USE_DNSSEC
+#undef RES_TRUSTAD
 #endif
 
  /*
@@ -70,6 +71,9 @@
 #ifndef RES_USE_EDNS0
 #define RES_USE_EDNS0	0
 #endif
+#ifndef RES_TRUSTAD
+#define RES_TRUSTAD	0
+#endif
 
  /*-
   * TLSA: https://tools.ietf.org/html/rfc6698#section-7.1
diff --git a/src/dns/dns_lookup.c b/src/dns/dns_lookup.c
index 1bfeb7e..2ae6483 100644
--- a/src/dns/dns_lookup.c
+++ b/src/dns/dns_lookup.c
@@ -116,6 +116,9 @@
 /*	Request DNSSEC validation. This flag is silently ignored
 /*	when the system stub resolver API, resolver(3), does not
 /*	implement DNSSEC.
+/*	Automatically turns on the RES_TRUSTAD flag on systems that
+/*	support this flag (this behavior will be more configurable
+/*	in a later release).
 /* .RE
 /* .IP lflags
 /*	Flags that control the operation of the dns_lookup*()
@@ -453,10 +456,10 @@ static int dns_query(const char *name, int type, unsigned flags,
     /*
      * Set extra options that aren't exposed to the application.
      */
-#define XTRA_FLAGS (RES_USE_EDNS0)
+#define XTRA_FLAGS (RES_USE_EDNS0 | RES_TRUSTAD)
 
     if (flags & RES_USE_DNSSEC)
-	flags |= RES_USE_EDNS0;
+	flags |= (RES_USE_EDNS0 | RES_TRUSTAD);
 
     /*
      * Save and restore resolver options that we overwrite, to avoid
diff --git a/src/dns/dns_str_resflags.c b/src/dns/dns_str_resflags.c
index 5f2cce5..df32345 100644
--- a/src/dns/dns_str_resflags.c
+++ b/src/dns/dns_str_resflags.c
@@ -60,10 +60,16 @@ static const LONG_NAME_MASK resflag_table[] = {
     "RES_DEFNAMES", RES_DEFNAMES,
     "RES_STAYOPEN", RES_STAYOPEN,
     "RES_DNSRCH", RES_DNSRCH,
+#ifdef RES_INSECURE1
     "RES_INSECURE1", RES_INSECURE1,
+#endif
+#ifdef RES_INSECURE2
     "RES_INSECURE2", RES_INSECURE2,
+#endif
     "RES_NOALIASES", RES_NOALIASES,
+#ifdef RES_USE_INET6
     "RES_USE_INET6", RES_USE_INET6,
+#endif
 #ifdef RES_ROTATE
     "RES_ROTATE", RES_ROTATE,
 #endif
diff --git a/src/global/mail_params.c b/src/global/mail_params.c
index 8953fe6..4b6a058 100644
--- a/src/global/mail_params.c
+++ b/src/global/mail_params.c
@@ -868,6 +868,8 @@ void    mail_params_init()
     var_smtputf8_enable = 0;
 #else
     midna_domain_transitional = var_idna2003_compat;
+    if (var_smtputf8_enable)
+	midna_domain_pre_chroot();
 #endif
     util_utf8_enable = var_smtputf8_enable;
 
diff --git a/src/global/mail_params.h b/src/global/mail_params.h
index 1f4c207..900ef51 100644
--- a/src/global/mail_params.h
+++ b/src/global/mail_params.h
@@ -4178,7 +4178,7 @@ extern char *var_maillog_file_pfxs;
 extern char *var_maillog_file_comp;
 
 #define VAR_MAILLOG_FILE_STAMP	"maillog_file_rotate_suffix"
-#define DEF_MAILLOG_FILE_STAMP	"%Y%M%d-%H%M%S"
+#define DEF_MAILLOG_FILE_STAMP	"%Y%m%d-%H%M%S"
 extern char *var_maillog_file_stamp;
 
 #define VAR_POSTLOG_SERVICE	"postlog_service_name"
diff --git a/src/global/mail_version.h b/src/global/mail_version.h
index 41647d3..95afa7b 100644
--- a/src/global/mail_version.h
+++ b/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20200312"
-#define MAIL_VERSION_NUMBER	"3.4.10"
+#define MAIL_RELEASE_DATE	"20200614"
+#define MAIL_VERSION_NUMBER	"3.4.13"
 
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
diff --git a/src/milter/milter.c b/src/milter/milter.c
index cee169c..3d71cc6 100644
--- a/src/milter/milter.c
+++ b/src/milter/milter.c
@@ -620,14 +620,14 @@ void    milter_disc_event(MILTERS *milters)
   * names by skipping the redundant "milter_" prefix.
   */
 static ATTR_OVER_TIME time_table[] = {
-    7 + VAR_MILT_CONN_TIME, DEF_MILT_CONN_TIME, 0, 1, 0,
-    7 + VAR_MILT_CMD_TIME, DEF_MILT_CMD_TIME, 0, 1, 0,
-    7 + VAR_MILT_MSG_TIME, DEF_MILT_MSG_TIME, 0, 1, 0,
+    7 + (const char *) VAR_MILT_CONN_TIME, DEF_MILT_CONN_TIME, 0, 1, 0,
+    7 + (const char *) VAR_MILT_CMD_TIME, DEF_MILT_CMD_TIME, 0, 1, 0,
+    7 + (const char *) VAR_MILT_MSG_TIME, DEF_MILT_MSG_TIME, 0, 1, 0,
     0,
 };
 static ATTR_OVER_STR str_table[] = {
-    7 + VAR_MILT_PROTOCOL, 0, 1, 0,
-    7 + VAR_MILT_DEF_ACTION, 0, 1, 0,
+    7 + (const char *) VAR_MILT_PROTOCOL, 0, 1, 0,
+    7 + (const char *) VAR_MILT_DEF_ACTION, 0, 1, 0,
     0,
 };
 
diff --git a/src/postfix/postfix.c b/src/postfix/postfix.c
index f8b3de4..b2306fb 100644
--- a/src/postfix/postfix.c
+++ b/src/postfix/postfix.c
@@ -242,7 +242,7 @@
 /*	logrotate".
 /* .IP "\fBmaillog_file_prefixes (/var, /dev/stdout)\fR"
 /*	A list of allowed prefixes for a maillog_file value.
-/* .IP "\fBmaillog_file_rotate_suffix (%Y%M%d-%H%M%S)\fR"
+/* .IP "\fBmaillog_file_rotate_suffix (%Y%m%d-%H%M%S)\fR"
 /*	The format of the suffix to append to $maillog_file while rotating
 /*	the file with "postfix logrotate".
 /* .IP "\fBpostlog_service_name (postlog)\fR"
diff --git a/src/smtpd/smtpd_check.c b/src/smtpd/smtpd_check.c
index d1caa5c..a25b401 100644
--- a/src/smtpd/smtpd_check.c
+++ b/src/smtpd/smtpd_check.c
@@ -483,20 +483,20 @@ typedef struct {
   * parameter names by skipping the redundant "smtpd_policy_service_" prefix.
   */
 static ATTR_OVER_TIME time_table[] = {
-    21 + VAR_SMTPD_POLICY_TMOUT, DEF_SMTPD_POLICY_TMOUT, 0, 1, 0,
-    21 + VAR_SMTPD_POLICY_IDLE, DEF_SMTPD_POLICY_IDLE, 0, 1, 0,
-    21 + VAR_SMTPD_POLICY_TTL, DEF_SMTPD_POLICY_TTL, 0, 1, 0,
-    21 + VAR_SMTPD_POLICY_TRY_DELAY, DEF_SMTPD_POLICY_TRY_DELAY, 0, 1, 0,
+    21 + (const char *) VAR_SMTPD_POLICY_TMOUT, DEF_SMTPD_POLICY_TMOUT, 0, 1, 0,
+    21 + (const char *) VAR_SMTPD_POLICY_IDLE, DEF_SMTPD_POLICY_IDLE, 0, 1, 0,
+    21 + (const char *) VAR_SMTPD_POLICY_TTL, DEF_SMTPD_POLICY_TTL, 0, 1, 0,
+    21 + (const char *) VAR_SMTPD_POLICY_TRY_DELAY, DEF_SMTPD_POLICY_TRY_DELAY, 0, 1, 0,
     0,
 };
 static ATTR_OVER_INT int_table[] = {
-    21 + VAR_SMTPD_POLICY_REQ_LIMIT, 0, 0, 0,
-    21 + VAR_SMTPD_POLICY_TRY_LIMIT, 0, 1, 0,
+    21 + (const char *) VAR_SMTPD_POLICY_REQ_LIMIT, 0, 0, 0,
+    21 + (const char *) VAR_SMTPD_POLICY_TRY_LIMIT, 0, 1, 0,
     0,
 };
 static ATTR_OVER_STR str_table[] = {
-    21 + VAR_SMTPD_POLICY_DEF_ACTION, 0, 1, 0,
-    21 + VAR_SMTPD_POLICY_CONTEXT, 0, 1, 0,
+    21 + (const char *) VAR_SMTPD_POLICY_DEF_ACTION, 0, 1, 0,
+    21 + (const char *) VAR_SMTPD_POLICY_CONTEXT, 0, 1, 0,
     0,
 };
 
diff --git a/src/tls/tls_bio_ops.c b/src/tls/tls_bio_ops.c
index 1f4ec41..9b66195 100644
--- a/src/tls/tls_bio_ops.c
+++ b/src/tls/tls_bio_ops.c
@@ -194,6 +194,13 @@ int     tls_bio(int fd, int timeout, TLS_SESS_STATE *TLScontext,
      * handling any pending network I/O.
      */
     for (;;) {
+
+	/*
+	 * Flush the per-thread SSL error queue. Otherwise, errors from other
+	 * code that also uses TLS may confuse SSL_get_error(3).
+	 */
+	ERR_clear_error();
+
 	if (hsfunc)
 	    status = hsfunc(TLScontext->con);
 	else if (rfunc)
diff --git a/src/tls/tls_misc.c b/src/tls/tls_misc.c
index 9fac444..1a1fd96 100644
--- a/src/tls/tls_misc.c
+++ b/src/tls/tls_misc.c
@@ -686,6 +686,27 @@ static int server_sni_callback(SSL *ssl, int *alert, void *arg)
 		 TLScontext->namaddr, sni);
 	return SSL_TLSEXT_ERR_NOACK;
     }
+
+    /*
+     * With TLS 1.3, when the client's proposed key share is not supported by
+     * the server, the server may issue a HelloRetryRequest (HRR), and the
+     * client will then retry with a new key share on a curve supported by
+     * the server.  This results in the SNI callback running twice for the
+     * same connection.
+     * 
+     * When that happens, The client MUST send the essentially the same hello
+     * message, including the SNI name, and since we've already loaded our
+     * certificate chain, we don't need to do it again!  Therefore, if we've
+     * already recorded the peer SNI name, just check that it has not
+     * changed, and return success.
+     */
+    if (TLScontext->peer_sni) {
+	if (strcmp(sni, TLScontext->peer_sni) == 0)
+	    return SSL_TLSEXT_ERR_OK;
+	msg_warn("TLS SNI changed from %s initially %s, %s after hello retry",
+		 TLScontext->namaddr, TLScontext->peer_sni, sni);
+	return SSL_TLSEXT_ERR_NOACK;
+    }
     do {
 	/* Don't silently skip maps opened with the wrong flags. */
 	pem = maps_file_find(tls_server_sni_maps, cp, 0);
diff --git a/src/tls/tls_session.c b/src/tls/tls_session.c
index 3f6027f..a4b7a8f 100644
--- a/src/tls/tls_session.c
+++ b/src/tls/tls_session.c
@@ -118,7 +118,7 @@ void    tls_session_stop(TLS_APPL_STATE *unused_ctx, VSTREAM *stream, int timeou
      * so we will not perform SSL_shutdown() and the session will be removed
      * as being bad.
      */
-    if (!failure) {
+    if (!failure && !SSL_in_init(TLScontext->con)) {
 	retval = tls_bio_shutdown(vstream_fileno(stream), timeout, TLScontext);
 	if (!var_tls_fast_shutdown && retval == 0)
 	    tls_bio_shutdown(vstream_fileno(stream), timeout, TLScontext);
diff --git a/src/tlsproxy/tlsproxy.c b/src/tlsproxy/tlsproxy.c
index 50b4154..65c7201 100644
--- a/src/tlsproxy/tlsproxy.c
+++ b/src/tlsproxy/tlsproxy.c
@@ -781,6 +781,7 @@ static void tlsp_strategy(TLSP_STATE *state)
      */
     if (state->flags & TLSP_FLAG_DO_HANDSHAKE) {
 	state->timeout = state->handshake_timeout;
+	ERR_clear_error();
 	if (state->is_server_role)
 	    ssl_stat = SSL_accept(tls_context->con);
 	else
@@ -809,6 +810,7 @@ static void tlsp_strategy(TLSP_STATE *state)
     if (NBBIO_ERROR_FLAGS(plaintext_buf)) {
 	if (NBBIO_ACTIVE_FLAGS(plaintext_buf))
 	    nbbio_disable_readwrite(state->plaintext_buf);
+	ERR_clear_error();
 	if (!SSL_in_init(tls_context->con)
 	    && (ssl_stat = SSL_shutdown(tls_context->con)) < 0) {
 	    handshake_err = SSL_get_error(tls_context->con, ssl_stat);
@@ -835,6 +837,7 @@ static void tlsp_strategy(TLSP_STATE *state)
      */
     ssl_write_err = SSL_ERROR_NONE;
     while (NBBIO_READ_PEND(plaintext_buf) > 0) {
+	ERR_clear_error();
 	ssl_stat = SSL_write(tls_context->con, NBBIO_READ_BUF(plaintext_buf),
 			     NBBIO_READ_PEND(plaintext_buf));
 	ssl_write_err = SSL_get_error(tls_context->con, ssl_stat);
@@ -865,6 +868,7 @@ static void tlsp_strategy(TLSP_STATE *state)
      */
     ssl_read_err = SSL_ERROR_NONE;
     while (NBBIO_WRITE_PEND(state->plaintext_buf) < NBBIO_BUFSIZE(plaintext_buf)) {
+	ERR_clear_error();
 	ssl_stat = SSL_read(tls_context->con,
 			    NBBIO_WRITE_BUF(plaintext_buf)
 			    + NBBIO_WRITE_PEND(state->plaintext_buf),
@@ -1489,16 +1493,15 @@ static void tlsp_service(VSTREAM *plaintext_stream,
 			    TLSP_INIT_TIMEOUT, (void *) state);
 }
 
-/* pre_jail_init - pre-jail initialization */
+/* pre_jail_init_server - pre-jail initialization */
 
-static void pre_jail_init(char *unused_name, char **unused_argv)
+static void pre_jail_init_server(void)
 {
     TLS_SERVER_INIT_PROPS props;
     const char *cert_file;
     int     have_server_cert;
     int     no_server_cert_ok;
     int     require_server_cert;
-    int     clnt_use_tls;
 
     /*
      * The code in this routine is pasted literally from smtpd(8). I am not
@@ -1531,7 +1534,7 @@ static void pre_jail_init(char *unused_name, char **unused_argv)
     }
     var_tlsp_use_tls = var_tlsp_use_tls || var_tlsp_enforce_tls;
     if (!var_tlsp_use_tls) {
-	msg_warn("TLS service is requested, but disabled with %s or %s",
+	msg_warn("TLS server role is disabled with %s or %s",
 		 VAR_TLSP_TLS_LEVEL, VAR_TLSP_USE_TLS);
 	return;
     }
@@ -1622,6 +1625,13 @@ static void pre_jail_init(char *unused_name, char **unused_argv)
 	SSL_CTX_set_mode(tlsp_server_ctx->ssl_ctx,
 			 SSL_MODE_ENABLE_PARTIAL_WRITE
 			 | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
+}
+
+/* pre_jail_init_client - pre-jail initialization */
+
+static void pre_jail_init_client(void)
+{
+    int     clnt_use_tls;
 
     /*
      * The cache with TLS_APPL_STATE instances for different TLS_CLIENT_INIT
@@ -1733,6 +1743,18 @@ static void pre_jail_init(char *unused_name, char **unused_argv)
 		msg_warn("TLS client initialization failed");
 	}
     }
+}
+
+/* pre_jail_init - pre-jail initialization */
+
+static void pre_jail_init(char *unused_name, char **unused_argv)
+{
+
+    /*
+     * Initialize roles separately.
+     */
+    pre_jail_init_server();
+    pre_jail_init_client();
 
     /*
      * tlsp_client_init() needs to know if it is called pre-jail or
diff --git a/src/util/midna_domain.c b/src/util/midna_domain.c
index 667e75e..333a5c9 100644
--- a/src/util/midna_domain.c
+++ b/src/util/midna_domain.c
@@ -20,6 +20,8 @@
 /*
 /*	const char *midna_domain_suffix_to_utf8(
 /*	const char *name)
+/* AUXILIARY FUNCTIONS
+/*	void midna_domain_pre_chroot(void)
 /* DESCRIPTION
 /*	The functions in this module transform domain names from/to
 /*	ASCII and UTF-8 form. The result is cached to avoid repeated
@@ -52,6 +54,8 @@
 /*
 /*	midna_domain_transitional enables transitional conversion
 /*	between UTF8 and ASCII labels.
+/*
+/*	midna_domain_pre_chroot() does some pre-chroot initialization.
 /* SEE ALSO
 /*	http://unicode.org/reports/tr46/ Unicode IDNA Compatibility processing
 /*	msg(3) diagnostics interface
@@ -144,6 +148,22 @@ static const char *midna_domain_strerror(UErrorCode error, int info_errors)
     }
 }
 
+/* midna_domain_pre_chroot - pre-chroot initialization */
+
+void    midna_domain_pre_chroot(void)
+{
+    UErrorCode error = U_ZERO_ERROR;
+    UIDNAInfo info = UIDNA_INFO_INITIALIZER;
+    UIDNA  *idna;
+
+    idna = uidna_openUTS46(midna_domain_transitional ? UIDNA_DEFAULT
+			   : UIDNA_NONTRANSITIONAL_TO_ASCII, &error);
+    if (U_FAILURE(error))
+	msg_warn("ICU library initialization failed: %s",
+		 midna_domain_strerror(error, info.errors));
+    uidna_close(idna);
+}
+
 /* midna_domain_to_ascii_create - convert domain to ASCII */
 
 static void *midna_domain_to_ascii_create(const char *name, void *unused_context)
@@ -327,6 +347,7 @@ const char *midna_domain_suffix_to_utf8(const char *name)
  /*
   * Test program - reads names from stdin, reports invalid names to stderr.
   */
+#include <unistd.h>
 #include <stdlib.h>
 #include <locale.h>
 
@@ -350,6 +371,11 @@ int     main(int argc, char **argv)
     /* msg_verbose = 1; */
     util_utf8_enable = 1;
 
+    if (geteuid() == 0) {
+	midna_domain_pre_chroot();
+	if (chroot(".") != 0)
+	    msg_fatal("chroot(\".\"): %m");
+    }
     while (vstring_fgets_nonl(buffer, VSTREAM_IN)) {
 	bp = STR(buffer);
 	msg_info("> %s", bp);
diff --git a/src/util/midna_domain.h b/src/util/midna_domain.h
index 03d875b..1abe2a1 100644
--- a/src/util/midna_domain.h
+++ b/src/util/midna_domain.h
@@ -18,6 +18,7 @@ extern const char *midna_domain_to_ascii(const char *);
 extern const char *midna_domain_to_utf8(const char *);
 extern const char *midna_domain_suffix_to_ascii(const char *);
 extern const char *midna_domain_suffix_to_utf8(const char *);
+extern void midna_domain_pre_chroot(void);
 
 extern int midna_domain_cache_size;
 extern int midna_domain_transitional;