Skip to content

Commit

Permalink
postfix-3.6.17
Browse files Browse the repository at this point in the history
  • Loading branch information
@wietse-postfix @hs-viktor
wietse-postfix authored and hs-viktor committed Feb 17, 2025
1 parent 4899ccf commit 507b515
Show file tree
Hide file tree
Showing 21 changed files with 358 additions and 57 deletions.
74 changes: 74 additions & 0 deletions postfix/HISTORY
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26193,3 +26193,77 @@ Apologies for any names omitted.
by Postfix (for example, a From: header with UTF8 full name
information from the password file). Reported by Michael
Tokarev. File: src/cleanup/cleanup_message.c.

20241205

Portability: include <sys_socket.h> for a SUNOS5 workaround.
Gary R. Schmidt. File: util/peekfd.c.

20241230

Bugfix (defect introduced: Postfix 3.3, date 20180107) small
memory leak in the cleanup daemon when generating a "From:
full-name <addr-spec>" message header. The impact is limited
because the number of requests is bounded by the "max_use"
configuration parameter. Found during code maintenance.
File: cleanup/cleanup_message.c.

20250111

Forward compatibility: ignore new queue file flag bits that may
be used with Postfix 3.10 and later. This is a safety in case
a Postfix 3.10 upgrade needs to be rolled back, after the new
TLS-Required feature has been used. Files: global/smtputf8.h,
*qmgr/qmgr_message.c.

20250115

Bugfix (defect introduced: Postfix 3.0): the bounce daemon
mangled a non-ASCII address localpart in the "X-Postfix-Sender:"
field of a delivery status notification. It backslash-escaped
each byte in a multi-byte character. This behavior was
implemented in Postfix 2.1 (no support for UTF8 local-parts),
but it became incorrect after SMTPUTF8 support was implemented
in Postfix 3.0. File: bounce/bounce_notify_util.c.

20250207

Performance: when a mysql: or pgsql: configuration specifies
a single host, assume that it is a load balancer and reconnect
immediately after a single failure, instead of failing all
requests for 60s. Files: global/dict_pgsql.c, global/dict_mysql.c.

20250210

Bugfix (defect introduced: Postfix 3.6): Reverted the default
smtp_tls_dane_insecure_mx_policy setting to "dane" as of Postfix
3.6.17, 3.7.13, 3.8.8, 3.9.2, and 3.10.0. By mistake the default
was dependent on the smtp_tls_security_level setting. Files:
global/mail_params.h, proto/postconf.proto, smtp/smtp.c.

20250212

Support for OpenSSL 3.5 post-quantum cryptography. To manage
algorithm selection, OpenSSL introduces new TLS group syntax
that Postfix will not attempt to imitate. Instead, Postfix
now allows the tls_eecdh_auto_curves and tls_ffdhe_auto_groups
parameter values to have an empty value. When both are set
empty, the algorithm selection can be managed through OpenSSL
configuration. Viktor Dukhovni. File: tls/tls_misc.c.

Bugfix (defect introduced: Postfix 3.4, date 20181113): a
server with multiple TLS certificates could report, for a
resumed TLS session, the wrong server-signature and
server-digest names in logging and Received: message headers.
Viktor Dukhovni. File: tls/tls_misc.c.

20250213

Documentation: updated postconf(5) that the parameters
smtpd_tls_eecdh_grade, tls_eecdh_strong_curve,
tls_eecdh_ultra_curve, and tlsproxy_tls_eecdh_grade, are
not used since Postfix 3.6; updated the tls_eecdh_auto_curves
and tls_ffdhe_auto_groups description with post-quantum
configuration; added a post-quantum example to the
tls_config_file description. File: proto/postconf.proto.
The unused parameters will be deleted in Postfix 3.11.
2 changes: 1 addition & 1 deletion postfix/html/lmtp.8.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -644,7 +644,7 @@

Available in Postfix version 3.1 and later:

<b><a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> (see 'postconf -d' output)</b>
<b><a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> (dane)</b>
The TLS policy for MX hosts with "secure" TLSA records when the
nexthop destination security level is <b>dane</b>, but the MX record
was found via an "insecure" MX lookup.
Expand Down
67 changes: 60 additions & 7 deletions postfix/html/postconf.5.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12675,7 +12675,7 @@ <h2> Postfix main.cf file format </h2>
</DD>

<DT><b><a name="smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a>
(default: see "postconf -d" output)</b></DT><DD>
(default: dane)</b></DT><DD>

<p> The TLS policy for MX hosts with "secure" TLSA records when the
nexthop destination security level is <b>dane</b>, but the MX
Expand All @@ -12699,10 +12699,9 @@ <h2> Postfix main.cf file format </h2>
"Verified", because the MX host name could have been forged. </dd>
</dl>

<p> The default setting for Postfix &ge; 3.6 is "dane" with
"<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = dane", otherwise "may". This behavior
was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21.
With earlier Postfix versions the default setting was always "dane".
<p> The default setting is "dane" as of Postfix versions 3.6.17,
3.7.13, 3.8.8, 3.9.2, and 3.10.0. With earlier versions the default
was mistakenly dependent on the <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> setting.
</p>

<p> Though with "insecure" MX records an active attacker can
Expand Down Expand Up @@ -17879,6 +17878,8 @@ <h2> Postfix main.cf file format </h2>
<b>auto</b> value (described below) was chosen.
</p>

<p> This feature is not used as of Postfix 3.6. Do not specify. </p>

<p> The available choices are: </p>

<dl>
Expand Down Expand Up @@ -19010,6 +19011,45 @@ <h2> Postfix main.cf file format </h2>
</pre>
</blockquote>

<p> Example: Custom OpenSSL group settings. </p>

<pre>
<a href="postconf.5.html">main.cf</a>:
<a href="postconf.5.html#tls_config_file">tls_config_file</a> = ${<a href="postconf.5.html#config_directory">config_directory</a>}/openssl.cnf
<a href="postconf.5.html#tls_config_name">tls_config_name</a> = postfix
</pre>

<pre>
openssl.cnf:
postfix = postfix_settings
</pre>

<pre>
[postfix_settings]
ssl_conf = postfix_ssl_settings
</pre>

<pre>
[postfix_ssl_settings]
system_default = baseline_postfix_settings
</pre>

<pre>
[baseline_postfix_settings]
# New OpenSSL 3.5 syntax, for older releases consider
# the Postfix default:
#
# Groups = X25519:X448:prime256v1:secp384r1:secp521r1:ffdhe2048:ffdhe3072
#
Groups = *X25519MLKEM768 / *X25519:X448 / P-256:P-384
</pre>

<p> Caution: It is typically best to just use the default OpenSSL
group settings, by setting "<a href="postconf.5.html#tls_config_file">tls_config_file</a> = none". Overly strict
system-wide TLS settings will conflict with Postfix's opportunistic
TLS, where being less restrictive is better than downgrading to
cleartext SMTP. </p>

<p> This feature is available in Postfix &ge; 3.9, 3.8.1, 3.7.6,
3.6.10, and 3.5.20. </p>

Expand Down Expand Up @@ -19202,8 +19242,7 @@ <h2> Postfix main.cf file format </h2>
(default: see "postconf -d" output)</b></DT><DD>

<p> The prioritized list of elliptic curves supported by the Postfix
SMTP client and server. These curves are used by the Postfix SMTP
server when "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = auto". The selected curves
SMTP client and server. The selected curves
must be implemented by OpenSSL and be standardized for use in TLS
(<a href="http://tools.ietf.org/html/rfc4492">RFC 4492</a> or its imminent successor). It is unwise to list only
"bleeding-edge" curves supported by a small subset of clients. The
Expand All @@ -19218,6 +19257,14 @@ <h2> Postfix main.cf file format </h2>
in the default value of this parameter, even though they'll only
be usable with later versions of OpenSSL. </p>

<p> Post-quantum cryptography support: OpenSSL 3.5 introduces new
configuration syntax that Postfix will not attempt to imitate.
Instead, with Postfix 3.6.17, 3.7.13, 3.8.8, 3.9.2, and later, set
both <a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a> and if available tls_ffdhe_auto_groups
to the empty value, to enable algorithm selection through OpenSSL
configuration. See <a href="postconf.5.html#tls_config_file">tls_config_file</a> for a configuration example.
</p>

<p> This feature is available in Postfix 3.2 and later, when it is
compiled and linked with OpenSSL 1.0.2 or later on platforms where
EC algorithms have not been disabled by the vendor. </p>
Expand All @@ -19241,6 +19288,8 @@ <h2> Postfix main.cf file format </h2>
is unwise to choose an "bleeding-edge" curve supported by only a
small subset of clients. </p>

<p> This feature is not used as of Postfix 3.6. Do not specify. </p>

<p> The default "strong" curve is rated in NSA <a
href="<a href="https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/">https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/</a>">Suite
B</a> for information classified up to SECRET. </p>
Expand Down Expand Up @@ -19282,6 +19331,8 @@ <h2> Postfix main.cf file format </h2>
"-list_curves" option) and be one of the curves listed in Section 5.1.1
of <a href="http://tools.ietf.org/html/rfc4492">RFC 4492</a>. You should not generally change this setting. </p>

<p> This feature is not used as of Postfix 3.6. Do not specify. </p>

<p> This default "ultra" curve is rated in NSA <a
href="<a href="https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/">https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/</a>">Suite
B</a> for information classified up to TOP SECRET. </p>
Expand Down Expand Up @@ -20202,6 +20253,8 @@ <h2> Postfix main.cf file format </h2>
elliptic-curve Diffie-Hellman (EECDH) key exchange. See
<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> for further details. </p>

<p> This feature is not used as of Postfix 3.6. Do not specify. </p>

<p> This feature is available in Postfix 2.8 and later. </p>


Expand Down
2 changes: 1 addition & 1 deletion postfix/html/smtp.8.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -644,7 +644,7 @@

Available in Postfix version 3.1 and later:

<b><a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> (see 'postconf -d' output)</b>
<b><a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> (dane)</b>
The TLS policy for MX hosts with "secure" TLSA records when the
nexthop destination security level is <b>dane</b>, but the MX record
was found via an "insecure" MX lookup.
Expand Down
86 changes: 79 additions & 7 deletions postfix/man/man5/postconf.5
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8158,7 +8158,7 @@ See "Client\-side
TLS connection reuse" for background details.
.PP
This feature is available in Postfix 3.4 and later.
.SH smtp_tls_dane_insecure_mx_policy (default: see "postconf \-d" output)
.SH smtp_tls_dane_insecure_mx_policy (default: dane)
The TLS policy for MX hosts with "secure" TLSA records when the
nexthop destination security level is \fBdane\fR, but the MX
record was found via an "insecure" MX lookup. The choices are:
Expand All @@ -8179,10 +8179,9 @@ authentication succeeds, it will be logged only as "Trusted", not
"Verified", because the MX host name could have been forged.
.br
.br
The default setting for Postfix >= 3.6 is "dane" with
"smtp_tls_security_level = dane", otherwise "may". This behavior
was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21.
With earlier Postfix versions the default setting was always "dane".
The default setting is "dane" as of Postfix versions 3.6.17,
3.7.13, 3.8.8, 3.9.2, and 3.10.0. With earlier versions the default
was mistakenly dependent on the smtp_tls_security_level setting.
.PP
Though with "insecure" MX records an active attacker can
compromise SMTP transport security by returning forged MX records,
Expand Down Expand Up @@ -12468,6 +12467,8 @@ Diffie\-Hellman (EECDH) key exchange. As of Postfix 3.6, the value of
this parameter is always ignored, and Postfix behaves as though the
\fBauto\fR value (described below) was chosen.
.PP
This feature is not used as of Postfix 3.6. Do not specify.
.PP
The available choices are:
.IP "\fBauto\fR"
Use the most preferred curve that is
Expand Down Expand Up @@ -13395,6 +13396,65 @@ MinProtocol = TLSv1
.ft R
.in -4
.PP
Example: Custom OpenSSL group settings.
.PP
.nf
.na
.ft C
main.cf:
tls_config_file = ${config_directory}/openssl.cnf
tls_config_name = postfix
.fi
.ad
.ft R
.PP
.nf
.na
.ft C
openssl.cnf:
postfix = postfix_settings
.fi
.ad
.ft R
.PP
.nf
.na
.ft C
[postfix_settings]
ssl_conf = postfix_ssl_settings
.fi
.ad
.ft R
.PP
.nf
.na
.ft C
[postfix_ssl_settings]
system_default = baseline_postfix_settings
.fi
.ad
.ft R
.PP
.nf
.na
.ft C
[baseline_postfix_settings]
# New OpenSSL 3.5 syntax, for older releases consider
# the Postfix default:
#
# Groups = X25519:X448:prime256v1:secp384r1:secp521r1:ffdhe2048:ffdhe3072
#
Groups = *X25519MLKEM768 / *X25519:X448 / P\-256:P\-384
.fi
.ad
.ft R
.PP
Caution: It is typically best to just use the default OpenSSL
group settings, by setting "tls_config_file = none". Overly strict
system\-wide TLS settings will conflict with Postfix's opportunistic
TLS, where being less restrictive is better than downgrading to
cleartext SMTP.
.PP
This feature is available in Postfix >= 3.9, 3.8.1, 3.7.6,
3.6.10, and 3.5.20.
.SH tls_config_name (default: empty)
Expand Down Expand Up @@ -13556,8 +13616,7 @@ Postfix >= 3.4. See \fBSSL_CTX_set_options\fR(3).
This feature is available in Postfix 2.8 and later.
.SH tls_eecdh_auto_curves (default: see "postconf \-d" output)
The prioritized list of elliptic curves supported by the Postfix
SMTP client and server. These curves are used by the Postfix SMTP
server when "smtpd_tls_eecdh_grade = auto". The selected curves
SMTP client and server. The selected curves
must be implemented by OpenSSL and be standardized for use in TLS
(RFC 4492 or its imminent successor). It is unwise to list only
"bleeding\-edge" curves supported by a small subset of clients. The
Expand All @@ -13572,6 +13631,13 @@ support for either or both may be missing. These curves may appear
in the default value of this parameter, even though they'll only
be usable with later versions of OpenSSL.
.PP
Post\-quantum cryptography support: OpenSSL 3.5 introduces new
configuration syntax that Postfix will not attempt to imitate.
Instead, with Postfix 3.6.17, 3.7.13, 3.8.8, 3.9.2, and later, set
both tls_eecdh_auto_curves and if available tls_ffdhe_auto_groups
to the empty value, to enable algorithm selection through OpenSSL
configuration. See tls_config_file for a configuration example.
.PP
This feature is available in Postfix 3.2 and later, when it is
compiled and linked with OpenSSL 1.0.2 or later on platforms where
EC algorithms have not been disabled by the vendor.
Expand All @@ -13589,6 +13655,8 @@ must support this curve for EECDH key exchange to take place. It
is unwise to choose an "bleeding\-edge" curve supported by only a
small subset of clients.
.PP
This feature is not used as of Postfix 3.6. Do not specify.
.PP
The default "strong" curve is rated in NSA Suite
B for information classified up to SECRET.
.PP
Expand Down Expand Up @@ -13621,6 +13689,8 @@ curve must be implemented by OpenSSL (as reported by \fBecparam\fR(1) with the
"\-list_curves" option) and be one of the curves listed in Section 5.1.1
of RFC 4492. You should not generally change this setting.
.PP
This feature is not used as of Postfix 3.6. Do not specify.
.PP
This default "ultra" curve is rated in NSA Suite
B for information classified up to TOP SECRET.
.PP
Expand Down Expand Up @@ -14233,6 +14303,8 @@ The Postfix \fBtlsproxy\fR(8) server security grade for ephemeral
elliptic\-curve Diffie\-Hellman (EECDH) key exchange. See
smtpd_tls_eecdh_grade for further details.
.PP
This feature is not used as of Postfix 3.6. Do not specify.
.PP
This feature is available in Postfix 2.8 and later.
.SH tlsproxy_tls_exclude_ciphers (default: $smtpd_tls_exclude_ciphers)
List of ciphers or cipher types to exclude from the \fBtlsproxy\fR(8)
Expand Down
2 changes: 1 addition & 1 deletion postfix/man/man8/smtp.8
View file
Original file line number Diff line number Diff line change
Expand Up @@ -584,7 +584,7 @@ Request that the Postfix SMTP client connects using the
legacy SMTPS protocol instead of using the STARTTLS command.
.PP
Available in Postfix version 3.1 and later:
.IP "\fBsmtp_tls_dane_insecure_mx_policy (see 'postconf -d' output)\fR"
.IP "\fBsmtp_tls_dane_insecure_mx_policy (dane)\fR"
The TLS policy for MX hosts with "secure" TLSA records when the
nexthop destination security level is \fBdane\fR, but the MX
record was found via an "insecure" MX lookup.
Expand Down
Loading

0 comments on commit 507b515

Please sign in to comment.