From c9115776d4a9e0b114441730560ae62d09a5f933 Mon Sep 17 00:00:00 2001
From: delphij <delphij@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Date: Thu, 18 Jun 2015 05:36:45 +0000
Subject: [PATCH] Raise the default for sendmail client connections to 1024-bit
 DH parameters to imporve TLS/DH interoperability with newer SSL/TLS suite,
 notably OpenSSL after FreeBSD 10.1-RELEASE-p12 (FreeBSD- SA-15:10.openssl).

This is MFC of r284436 (gshapiro), the original commit message
was:

===
The import of openssl to address the FreeBSD-SA-15:10.openssl security
advisory includes a change which rejects handshakes with DH parameters
below 768 bits.  sendmail releases prior to 8.15.2 (not yet released),
defaulted to a 512 bit DH parameter setting for client connections.
This commit chages that default to 1024 bits.  sendmail 8.15.2, when
released well use a default of 2048 bits.
===

Reported by:	Frank Seltzer
Errata Notice:	FreeBSD-EN-15:08.sendmail
Approved by:	so


git-svn-id: svn://svn.freebsd.org/base/releng/9.3@284536 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
---
 UPDATING                   | 3 +++
 contrib/sendmail/src/tls.c | 6 +++---
 sys/conf/newvers.sh        | 2 +-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/UPDATING b/UPDATING
index ade4d5303..1c0be982a 100644
--- a/UPDATING
+++ b/UPDATING
@@ -11,6 +11,9 @@ handbook:
 Items affecting the ports and packages system can be found in
 /usr/ports/UPDATING.  Please read that file before running portupgrade.
 
+20150618:	p17	FreeBSD-EN-15:08.sendmail
+	Improvements to sendmail TLS/DH interoperability. [EN-15:08]
+
 20150612:	p16	FreeBSD-SA-15:10.openssl
 	Fix multiple vulnerabilities in OpenSSL.  [SA-15:10]
 
diff --git a/contrib/sendmail/src/tls.c b/contrib/sendmail/src/tls.c
index 75207ee4a..ca93ee8b7 100644
--- a/contrib/sendmail/src/tls.c
+++ b/contrib/sendmail/src/tls.c
@@ -650,7 +650,7 @@ inittls(ctx, req, options, srv, certfile, keyfile, cacertpath, cacertfile, dhpar
 	**  1024	generate 1024 bit parameters
 	**  2048	generate 2048 bit parameters
 	**  /file/name	read parameters from /file/name
-	**  default is: 1024 for server, 512 for client (OK? XXX)
+	**  default is: 1024
 	*/
 
 	if (bitset(TLS_I_TRY_DH, req))
@@ -676,8 +676,8 @@ inittls(ctx, req, options, srv, certfile, keyfile, cacertpath, cacertfile, dhpar
 		}
 		if (dhparam == NULL)
 		{
-			dhparam = srv ? "1" : "5";
-			req |= (srv ? TLS_I_DH1024 : TLS_I_DH512);
+			dhparam = "1";
+			req |= TLS_I_DH1024;
 		}
 		else if (*dhparam == '/')
 		{
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 7561a45f6..4c4debea7 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
 
 TYPE="FreeBSD"
 REVISION="9.3"
-BRANCH="RELEASE-p16"
+BRANCH="RELEASE-p17"
 if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
 	BRANCH=${BRANCH_OVERRIDE}
 fi
-- 
2.42.0