#! /bin/sh /usr/share/dpatch/dpatch-run
## 10tls.dpatch by LaMont Jones <lamont@debian.org>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: Debian tweaks to the default tls config

@DPATCH@
diff -urNad postfix-2.3.4~/conf/main.cf.tls postfix-2.3.4/conf/main.cf.tls
--- postfix-2.3.4~/conf/main.cf.tls	1970-01-01 02:00:00.000000000 +0200
+++ postfix-2.3.4/conf/main.cf.tls	2006-11-16 19:57:50.000000000 +0200
@@ -0,0 +1,11 @@
+
+# TLS parameters
+smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
+smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
+smtpd_use_tls=yes
+smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
+smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
+
+# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
+# information on enabling SSL in the smtp client.
+
diff -urNad postfix-2.3.4~/src/global/mail_params.h postfix-2.3.4/src/global/mail_params.h
--- postfix-2.3.4~/src/global/mail_params.h	2006-11-16 19:57:50.000000000 +0200
+++ postfix-2.3.4/src/global/mail_params.h	2006-11-16 19:57:50.000000000 +0200
@@ -591,7 +591,7 @@
 extern int var_dup_filter_limit;
 
 #define VAR_TLS_RAND_EXCH_NAME	"tls_random_exchange_name"
-#define DEF_TLS_RAND_EXCH_NAME	"${config_directory}/prng_exch"
+#define DEF_TLS_RAND_EXCH_NAME	"${queue_directory}/prng_exch"
 extern char *var_tls_rand_exch_name;
 
 #define VAR_TLS_RAND_SOURCE	"tls_random_source"
diff -urNad postfix-2.3.4~/src/xsasl/xsasl_cyrus_client.c postfix-2.3.4/src/xsasl/xsasl_cyrus_client.c
--- postfix-2.3.4~/src/xsasl/xsasl_cyrus_client.c	2006-06-26 15:59:19.000000000 +0300
+++ postfix-2.3.4/src/xsasl/xsasl_cyrus_client.c	2006-11-16 19:57:50.000000000 +0200
@@ -222,6 +222,10 @@
      */
     static sasl_callback_t callbacks[] = {
 	{SASL_CB_LOG, &xsasl_cyrus_log, 0},
+	{SASL_CB_GETPATH,&xsasl_getpath, 0},
+#if SASL_VERSION_MAJOR >= 2 && (SASL_VERSION_MAJOR > 2 || SASL_VERSION_MINOR >= 1) && (SASL_VERSION_MAJOR > 2 || (SASL_VERSION_MINOR > 1 || SASL_VERSION_STEP >= 22))
+   {SASL_CB_GETCONFPATH,&xsasl_getconfpath, 0},
+#endif
 	{SASL_CB_LIST_END, 0, 0}
     };
 
diff -urNad postfix-2.3.4~/src/xsasl/xsasl_cyrus_common.h postfix-2.3.4/src/xsasl/xsasl_cyrus_common.h
--- postfix-2.3.4~/src/xsasl/xsasl_cyrus_common.h	2005-12-20 19:48:22.000000000 +0200
+++ postfix-2.3.4/src/xsasl/xsasl_cyrus_common.h	2006-11-16 19:58:26.000000000 +0200
@@ -16,12 +16,18 @@
   */
 #if defined(USE_SASL_AUTH) && defined(USE_CYRUS_SASL)
 
+#include <sasl.h>
+
 #define NO_SASL_LANGLIST	((const char *) 0)
 #define NO_SASL_OUTLANG		((const char **) 0)
 #define xsasl_cyrus_strerror(status) \
 	sasl_errstring((status), NO_SASL_LANGLIST, NO_SASL_OUTLANG)
 extern int xsasl_cyrus_log(void *, int, const char *);
 extern int xsasl_cyrus_security_parse_opts(const char *);
+extern int xsasl_getpath(void * context, char ** path);
+#if SASL_VERSION_MAJOR >= 2 && (SASL_VERSION_MAJOR > 2 || SASL_VERSION_MINOR >= 1) && (SASL_VERSION_MAJOR > 2 || (SASL_VERSION_MINOR > 1 || SASL_VERSION_STEP >= 22))
+extern int xsasl_getconfpath(void * context, char ** path);
+#endif
 
 #endif
 
diff -urNad postfix-2.3.4~/src/xsasl/xsasl_cyrus_log.c postfix-2.3.4/src/xsasl/xsasl_cyrus_log.c
--- postfix-2.3.4~/src/xsasl/xsasl_cyrus_log.c	2005-12-20 19:48:22.000000000 +0200
+++ postfix-2.3.4/src/xsasl/xsasl_cyrus_log.c	2006-11-16 19:57:50.000000000 +0200
@@ -28,6 +28,7 @@
 /* System library. */
 
 #include <sys_defs.h>
+#include <string.h>
 
 /* Utility library. */
 
@@ -101,4 +102,22 @@
     return (SASL_OK);
 }
 
+int xsasl_getpath(void * context, char ** path)
+{
+#if SASL_VERSION_MAJOR >= 2
+    *path = strdup("/etc/postfix/sasl:/usr/lib/sasl2");
+#else
+    *path = strdup("/etc/postfix/sasl:/usr/lib/sasl");
+#endif
+    return SASL_OK;
+}
+
+#if SASL_VERSION_MAJOR >= 2 && (SASL_VERSION_MAJOR > 2 || SASL_VERSION_MINOR >= 1) && (SASL_VERSION_MAJOR > 2 || (SASL_VERSION_MINOR > 1 || SASL_VERSION_STEP >= 22))
+int xsasl_getconfpath(void * context, char ** path)
+{
+    *path = strdup("/etc/postfix/sasl:/usr/lib/sasl2");
+    return SASL_OK;
+}
+#endif
+
 #endif
diff -urNad postfix-2.3.4~/src/xsasl/xsasl_cyrus_server.c postfix-2.3.4/src/xsasl/xsasl_cyrus_server.c
--- postfix-2.3.4~/src/xsasl/xsasl_cyrus_server.c	2006-06-26 15:59:19.000000000 +0300
+++ postfix-2.3.4/src/xsasl/xsasl_cyrus_server.c	2006-11-16 19:57:50.000000000 +0200
@@ -174,6 +174,10 @@
 
 static sasl_callback_t callbacks[] = {
     {SASL_CB_LOG, &xsasl_cyrus_log, NO_CALLBACK_CONTEXT},
+    {SASL_CB_GETPATH,&xsasl_getpath, 0},
+#if SASL_VERSION_MAJOR >= 2 && (SASL_VERSION_MAJOR > 2 || SASL_VERSION_MINOR >= 1) && (SASL_VERSION_MAJOR > 2 || (SASL_VERSION_MINOR > 1 || SASL_VERSION_STEP >= 22))
+    {SASL_CB_GETCONFPATH,&xsasl_getconfpath, 0},
+#endif
     {SASL_CB_LIST_END, 0, 0}
 };