from smtpd to cleanup broke in the middle. Found by Coverity.
File: milter/milter.c.
+20060716
+
+ Bugfix: "sendmail -bs" panic caused by a missing
+ SMTPD_STATE_ALONE() guard before a milter_abort() call.
+ File: smtpd/smtpd.c.
+
+ Bugfix (bug introduced with Postfix 2.2): the Postfix SMTP
+ client enforced Mandatory TLS only when talking to an ESMTP
+ server. Victor Duchovni. File: src/smtp/smtp_proto.c.
+
+20060718
+
+ Bugfix (bug introduced 20060711): null pointer bug when
+ rejecting SMTP mail with Milter application. File:
+ cleanup/cleanup_milter.c.
+
+ Workaround (problem introduced in 200605/200606 TLS update):
+ the Postfix SMTP server now issues TLS session IDs even
+ when TLS session caching is turned off, otherwise MS Outlook
+ fails to deliver mail. There may also be interoperability
+ issues with other MTAs that we haven't discovered yet.
+ Specify "smtpd_tls_always_issue_session_ids = no" to disable
+ the workaround. Victor Duchovni. Files: smtpd/smtpd.c,
+ tls/tls_server.c.
+
+20060719
+
+ Cleanup: the smtp_sasl_auth_enforce feature is gone. It was
+ meant to work around a problem that was introduced with
+ plaintext fallback after a failed TLS handshake. Unfortunately,
+ it created more problems than it solved. We now address the
+ underlying problem more directly as described next. File:
+ smtp/smtp_proto.c.
+
+ Safety: with plaintext fallback after failed TLS handshake,
+ the Postfix SMTP client defers mail if the server does not
+ support SASL over plaintext, while the Postfix SMTP client
+ would have attempted to log in with SASL after successful
+ TLS handshake. This prevents mail from being rejected with
+ insufficient mail relay permission. Files: smtp/smtp_connect.c,
+ smtp/smtp_session.c, smtp/smtp_proto.c.
+
Wish list:
+ Add M flag (enable multi-recipient delivery) to pipe daemon.
+
The usage of TLScontext->cache_type is unclear. It specifies
a TLS session cache type (smtpd, smtp, or lmtp), but it is
sometimes used as an indicator that TLS session caching is
real client name IP address. See smtp(8) and XFORWARD_README for more
information.
- * With "-o disable_mime_output_conversion=yes", the scan delivery agent will
- not convert 8BITMIME mail to quoted-printable form while delivering to the
- content filter, as that would invalidate domainkeys and other digital
- signatures. This workaround is needed because some SMTP-based content
- filters don't announce 8BITMIME support, even though they can handle it
- just fine.
+ * The "-o disable_mime_output_conversion=yes" is a workaround that prevents
+ the breaking of domainkeys and other digital signatures. This is needed
+ because some SMTP-based content filters don't announce 8BITMIME support,
+ even though they can handle it just fine.
A\bAd\bdv\bva\ban\bnc\bce\bed\bd c\bco\bon\bnt\bte\ben\bnt\bt f\bfi\bil\blt\bte\ber\br:\b: r\bru\bun\bnn\bni\bin\bng\bg t\bth\bhe\be c\bco\bon\bnt\bte\ben\bnt\bt f\bfi\bil\blt\bte\ber\br
W\bWo\bor\brk\bka\bar\bro\bou\bun\bnd\bds\bs
Content filters may break domain key etc. signatures. If you use an SMTP-based
-filter as described in FILTER_README, then you should add a line to master.cf
-with "disable_mime_output_conversion = yes", as described in the advanced
-content filter example.
+content filter, then you should add a line to master.cf with "-
+o disable_mime_output_conversion=yes" (note: no spaces around the "="), as
+described in the advanced content filter example.
Sendmail Milter applications were originally developed for the Sendmail version
8 MTA, which has a different architecture than Postfix. The result is that some
To generate the necessary Makefiles, execute the following in the Postfix top-
level directory:
- % make makefiles CCARGS='-DUSE_SASL_AUTH -DDEF_SASL_SERVER=\"dovecot\"'
+ % make makefiles CCARGS='-DUSE_SASL_AUTH -
+ DDEF_SASL_SERVER_TYPE=\"dovecot\"'
After this, proceed with "make" as described in the INSTALL document.
Notes:
- * The "-DDEF_SASL_SERVER" stuff is not necessary; it just makes Postfix
+ * The "-DDEF_SASL_SERVER_TYPE" stuff is not necessary; it just makes Postfix
configuration a little more convenient because you don't have to specify
the SASL plug-in type in the Postfix main.cf file.
It is strictly discouraged to use this mode from main.cf. If you want to
support this service, enable a special port in master.cf and specify "-
-o smtpd_tls_wrappermode = yes" as an smtpd(8) command line option. Port 465
-(smtps) was once chosen for this feature.
+o smtpd_tls_wrappermode=yes" (note: no space around the "=") as an smtpd(8)
+command line option. Port 465 (smtps) was once chosen for this feature.
Example:
/etc/postfix/main.cf:
smtpd_tls_session_cache_timeout = 3600s
+When the Postfix SMTP server does not save TLS sessions to an external cache
+database, client-side session caching is unlikely to be useful. To prevent such
+wastage, the Postfix SMTP server can be configured to not issue TLS session
+ids. By default the Postfix SMTP server always issues TLS session ids. This
+works around known interoperability issues with some MUAs, and prevents
+possible interoperability issues with other MTAs.
+
+Example:
+
+ smtpd_tls_always_issue_session_ids = no
+
S\bSe\ber\brv\bve\ber\br a\bac\bcc\bce\bes\bss\bs c\bco\bon\bnt\btr\bro\bol\bl
Postfix TLS support introduces three additional features for Postfix SMTP
$html_directory/postconf.5.html:f:root:-:644
$html_directory/postdrop.1.html:f:root:-:644
$html_directory/postfix-logo.jpg:f:root:-:644
+$html_directory/postfix-manuals.html:f:root:-:644
$html_directory/postfix.1.html:f:root:-:644
$html_directory/postkick.1.html:f:root:-:644
$html_directory/postlock.1.html:f:root:-:644
the real client name IP address. See <a href="smtp.8.html">smtp(8)</a> and <a href="XFORWARD_README.html">XFORWARD_README</a>
for more information. </p>
-<li> <p> With "-o <a href="postconf.5.html#disable_mime_output_conversion">disable_mime_output_conversion</a>=yes", the scan
-delivery agent will not convert 8BITMIME mail to quoted-printable
-form while delivering to the content filter, as that would invalidate
-domainkeys and other digital signatures. This workaround is needed
-because some SMTP-based content filters don't announce 8BITMIME
-support, even though they can handle it just fine. </p>
+<li> <p> The "-o <a href="postconf.5.html#disable_mime_output_conversion">disable_mime_output_conversion</a>=yes" is a workaround
+that prevents the breaking of domainkeys and other digital signatures.
+This is needed because some SMTP-based content filters don't announce
+8BITMIME support, even though they can handle it just fine. </p>
</ul>
<h2><a name="workarounds">Workarounds</a></h2>
<p> Content filters may break domain key etc. signatures. If you
-use an SMTP-based filter as described in <a href="FILTER_README.html">FILTER_README</a>, then you
-should add a line to <a href="master.5.html">master.cf</a> with "<a href="postconf.5.html#disable_mime_output_conversion">disable_mime_output_conversion</a>
-
= yes", as described in the <a
+use an SMTP-based content filter, then you should add a line to
+<a href="master.5.html">master.cf</a> with "-o <a href="postconf.5.html#disable_mime_output_conversion">disable_mime_output_conversion</a>=yes" (note: no
+
spaces around the "="), as described in the <a
href="FILTER_README.html#advanced_filter">advanced content filter</a>
example. </p>
<blockquote>
<pre>
-% make makefiles CCARGS='-DUSE_SASL_AUTH -DDEF_SASL_SERVER=\"dovecot\"'
+% make makefiles CCARGS='-DUSE_SASL_AUTH -DDEF_SASL_SERVER_TYPE=\"dovecot\"'
</pre>
</blockquote>
<ul>
-<li> <p> The "-DDEF_SASL_SERVER" stuff is not necessary; it just
+<li> <p> The "-DDEF_SASL_SERVER_TYPE" stuff is not necessary; it just
makes Postfix configuration a little more convenient because you
don't have to specify the SASL plug-in type in the Postfix <a href="postconf.5.html">main.cf</a>
file. </p>
<p> It is strictly discouraged to use this mode from <a href="postconf.5.html">main.cf</a>. If
you want to support this service, enable a special port in <a href="master.5.html">master.cf</a>
-and specify "-o <a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a> = yes" as an <a href="smtpd.8.html">smtpd(8)</a> command
-line option. Port 465 (smtps) was once chosen for this feature.
+and specify "-o <a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a>=yes" (note: no space around
+the "=") as an <a href="smtpd.8.html">smtpd(8)</a> command line option. Port 465 (smtps) was
+once chosen for this feature.
</p>
<p> Example: </p>
</pre>
</blockquote>
+<p> When the Postfix SMTP server does not save TLS sessions to an
+external cache database, client-side session caching is unlikely
+to be useful. To prevent such wastage, the Postfix SMTP server can
+be configured to not issue TLS session ids. By default the Postfix
+SMTP server always issues TLS session ids. This works around known
+interoperability issues with some MUAs, and prevents possible
+interoperability issues with other MTAs. </p>
+
+<p> Example: </p>
+
+<blockquote>
+<pre>
+ <a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> = no
+</pre>
+</blockquote>
+
<h3><a name="server_access">Server access control</a> </h3>
<p> Postfix TLS support introduces three additional features for
</p>
-</DD>
-
-<DT><b><a name="lmtp_sasl_auth_enforce">lmtp_sasl_auth_enforce</a>
-(default: yes)</b></DT><DD>
-
-<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_sasl_auth_enforce">smtp_sasl_auth_enforce</a>
-configuration parameter. See there for details. </p>
-
-<p> This feature is available in Postfix 2.3 and later. </p>
-
-
</DD>
<DT><b><a name="lmtp_sasl_mechanism_filter">lmtp_sasl_mechanism_filter</a>
</pre>
-</DD>
-
-<DT><b><a name="smtp_sasl_auth_enforce">smtp_sasl_auth_enforce</a>
-(default: yes)</b></DT><DD>
-
-<p> If sender-dependent SASL passwords are turned off, defer mail
-delivery when an SMTP server does not support SASL authentication,
-while <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a> contains SASL login/password information
-for that server. </p>
-
-<p> This feature is available in Postfix 2.3 and later. </p>
-
-
</DD>
<DT><b><a name="smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a>
<DT><b><a name="smtpd_peername_lookup">smtpd_peername_lookup</a>
(default: yes)</b></DT><DD>
-<p> Attempt to look up the Postfix SMTP client hostname, and verify that
+<p> Attempt to look up the remote SMTP client hostname, and verify that
the name matches the client IP address. A client name is set to
"unknown" when it cannot be looked up or verified, or when name
lookup is disabled. Turning off name lookup reduces delays due to
<p> This feature is available in Postfix 2.2 and later. </p>
+</DD>
+
+<DT><b><a name="smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a>
+(default: yes)</b></DT><DD>
+
+<p> Force the Postfix SMTP server to issue a TLS session id, even
+when TLS session caching is turned off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>
+is empty). This behavior is compatible with Postfix < 2.3. </p>
+
+<p> With Postfix 2.3 and later the Postfix SMTP server can disable
+session id generation when TLS session caching is turned off. This
+keeps clients from caching sessions that almost certainly cannot
+be re-used. </p>
+
+<p> By default, the Postfix SMTP server always generates TLS session
+ids. This works around a known defect in mail client applications
+such as MS Outlook, and may also prevent interoperability issues
+with other MTAs. </p>
+
+<p> Example: </p>
+
+<blockquote>
+<pre>
+ <a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> = no
+</pre>
+</blockquote>
+
+<p> This feature is available in Postfix 2.3 and later. </p>
+
+
</DD>
<DT><b><a name="smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>
<li> <a href="bounce.5.html">bounce(5)</a>, Postfix bounce message templates
-<li> <a href="master.5.html">master(5)</a>, Postfix master.cf file syntax
+<li> <a href="master.5.html">master(5)</a>, Postfix <a href="master.5.html">master.cf</a> file syntax
-<li> <a href="postconf.5.html">postconf(5)</a>, Postfix main.cf file syntax
+<li> <a href="postconf.5.html">postconf(5)</a>, Postfix <a href="postconf.5.html">main.cf</a> file syntax
</ul>
<b>postfix-files</b> file.
Specify <i>name</i>=<i>value</i> to override and update specific
- main.cf configuration parameters. Use this, for
+ <a href="postconf.5.html">main.cf</a> configuration parameters. Use this, for
example, to change the <b><a href="postconf.5.html#mail_owner">mail_owner</a></b> or <b><a href="postconf.5.html#setgid_group">setgid_group</a></b>
setting for an already installed Postfix system.
<b>fix/post-install set-permissions</b>".
<b>upgrade-configuration [</b><i>name</i>=<i>value ...</i><b>]</b>
- Update the <b>main.cf</b> and <b>master.cf</b> files with infor-
+ Update the <a href="postconf.5.html"><b>main.cf</b></a> and <a href="master.5.html"><b>master.cf</b></a> files with infor-
mation that Postfix needs in order to run: add or
update services, and add or update configuration
parameter settings.
Specify <i>name</i>=<i>value</i> to override and update specific
- main.cf configuration parameters.
+ <a href="postconf.5.html">main.cf</a> configuration parameters.
This feature is available in Postfix 2.1 and later.
With Postfix 2.0 and earlier, use "<b>/etc/post-</b>
The following options are implemented:
<b>-c</b> <i>config</i><b>_</b><i>dir</i>
- Read the <b>main.cf</b> and <b>master.cf</b> configuration files
+ Read the <a href="postconf.5.html"><b>main.cf</b></a> and <a href="master.5.html"><b>master.cf</b></a> configuration files
in the named directory instead of the default con-
figuration directory. Use this to distinguish
between multiple Postfix instances on the same
present.
<b>CONFIGURATION PARAMETERS</b>
- The following <b>main.cf</b> configuration parameters are
+ The following <a href="postconf.5.html"><b>main.cf</b></a> configuration parameters are
exported as environment variables with the same names:
<b><a href="postconf.5.html#command_directory">command_directory</a> (see 'postconf -d' output)</b>
daemon programs.
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix main.cf and
- master.cf configuration files.
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and
+ <a href="master.5.html">master.cf</a> configuration files.
<b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
The location of the Postfix top-level queue direc-
Other configuration parameters:
<b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
- The default location of the Postfix main.cf and
- master.cf configuration files.
+ The default location of the Postfix <a href="postconf.5.html">main.cf</a> and
+ <a href="master.5.html">master.cf</a> configuration files.
<b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
The list of environment parameters that a Postfix
becomes, for example, "postfix/smtpd".
<b>FILES</b>
- /etc/postfix/main.cf, Postfix configuration parameters
- /etc/postfix/master.cf, Postfix daemon processes
+ /etc/postfix/<a href="postconf.5.html">main.cf</a>, Postfix configuration parameters
+ /etc/postfix/<a href="master.5.html">master.cf</a>, Postfix daemon processes
/etc/postfix/postfix-files, file/directory permissions
/etc/postfix/postfix-script, administrative commands
/etc/postfix/post-install, post-installation configuration
Postfix configuration:
<a href="bounce.5.html">bounce(5)</a>, Postfix bounce message templates
- <a href="master.5.html">master(5)</a>, Postfix master.cf file syntax
- <a href="postconf.5.html">postconf(5)</a>, Postfix main.cf file syntax
+ <a href="master.5.html">master(5)</a>, Postfix <a href="master.5.html">master.cf</a> file syntax
+ <a href="postconf.5.html">postconf(5)</a>, Postfix <a href="postconf.5.html">main.cf</a> file syntax
Table-driven mechanisms:
<a href="access.5.html">access(5)</a>, Postfix SMTP access control table
P.O. Box 704
Yorktown Heights, NY 10598, USA
+ TLS support by:
+ Lutz Jaenicke
+ Brandenburg University of Technology
+ Cottbus, Germany
+
+ Victor Duchovni
+ Morgan Stanley
+
SASL support originally by:
Till Franke
SuSE Rhein/Main AG
Available in Postfix version 2.3 and later:
- <b><a href="postconf.5.html#smtp_sasl_auth_enforce">smtp_sasl_auth_enforce</a> (yes)</b>
- If sender-dependent SASL passwords are turned off,
- defer mail delivery when an SMTP server does not
- support SASL authentication, while <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_pass</a>-
- <a href="postconf.5.html#smtp_sasl_password_maps">word_maps</a> contains SASL login/password information
- for that server.
-
<b><a href="postconf.5.html#smtp_sender_dependent_authentication">smtp_sender_dependent_authentication</a> (no)</b>
Enable sender-dependent authentication in the Post-
fix SMTP client; this is available only with SASL
offers STARTTLS, when TLS is not already enabled
for that server.
+ <b><a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> (empty)</b>
+ Optional lookup tables with the Postfix SMTP client
+ TLS security policy by next-hop destination; when a
+ non-empty value is specified, this overrides the
+ obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter.
+
+ <b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (SSLv3, TLSv1)</b>
+ List of TLS protocols that the Postfix SMTP client
+ will use with mandatory TLS encryption.
+
<b><a href="postconf.5.html#smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a> (5)</b>
The verification depth for remote SMTP server cer-
tificates.
Postpone the start of an SMTP mail transaction
until a valid RCPT TO command is received.
+ Available in Postfix version 2.3 and later:
+
+ <b><a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> (yes)</b>
+ Force the Postfix SMTP server to issue a TLS ses-
+ sion id, even when TLS session caching is turned
+ off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a> is empty).
+
<b>ADDRESS REWRITING CONTROLS</b>
See the <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> document for a detailed
discussion of Postfix address rewriting.
authority (CA) that issued the Postfix SMTP server
certificate.
+ <b><a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> (yes)</b>
+ Force the Postfix SMTP server to issue a TLS ses-
+ sion id, even when TLS session caching is turned
+ off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a> is empty).
+
<b><a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> (no)</b>
Ask a remote SMTP client for a client certificate.
Available in Postfix version 2.3 and later:
<b><a href="postconf.5.html#smtpd_peername_lookup">smtpd_peername_lookup</a> (yes)</b>
- Attempt to look up the Postfix SMTP client host-
- name, and verify that the name matches the client
- IP address.
+ Attempt to look up the remote SMTP client hostname,
+ and verify that the name matches the client IP
+ address.
The per SMTP client connection count and request rate lim-
its are implemented in co-operation with the <a href="anvil.8.html"><b>anvil</b>(8)</a> ser-
P.O. Box 704
Yorktown Heights, NY 10598, USA
+TLS support by:
+Lutz Jaenicke
+Brandenburg University of Technology
+Cottbus, Germany
+
+Victor Duchovni
+Morgan Stanley
+
SASL support originally by:
Till Franke
SuSE Rhein/Main AG
The default time unit is s (seconds).
.SH lmtp_sasl_auth_enable (default: no)
Enable SASL authentication in the Postfix LMTP client.
-.SH lmtp_sasl_auth_enforce (default: yes)
-The LMTP-specific version of the smtp_sasl_auth_enforce
-configuration parameter. See there for details.
-.PP
-This feature is available in Postfix 2.3 and later.
.SH lmtp_sasl_mechanism_filter (default: empty)
The LMTP-specific version of the smtp_sasl_mechanism_filter
configuration parameter. See there for details.
.fi
.ad
.ft R
-.SH smtp_sasl_auth_enforce (default: yes)
-If sender-dependent SASL passwords are turned off, defer mail
-delivery when an SMTP server does not support SASL authentication,
-while smtp_sasl_password_maps contains SASL login/password information
-for that server.
-.PP
-This feature is available in Postfix 2.3 and later.
.SH smtp_sasl_mechanism_filter (default: empty)
If non-empty, a Postfix SMTP client filter for the remote SMTP
server's list of offered SASL mechanisms. Different client and
The lookup key to be used in SMTP \fBaccess\fR(5) tables instead of the
null sender address.
.SH smtpd_peername_lookup (default: yes)
-Attempt to look up the Postfix SMTP client hostname, and verify that
+Attempt to look up the remote SMTP client hostname, and verify that
the name matches the client IP address. A client name is set to
"unknown" when it cannot be looked up or verified, or when name
lookup is disabled. Turning off name lookup reduces delays due to
.ft R
.PP
This feature is available in Postfix 2.2 and later.
+.SH smtpd_tls_always_issue_session_ids (default: yes)
+Force the Postfix SMTP server to issue a TLS session id, even
+when TLS session caching is turned off (smtpd_tls_session_cache_database
+is empty). This behavior is compatible with Postfix < 2.3.
+.PP
+With Postfix 2.3 and later the Postfix SMTP server can disable
+session id generation when TLS session caching is turned off. This
+keeps clients from caching sessions that almost certainly cannot
+be re-used.
+.PP
+By default, the Postfix SMTP server always generates TLS session
+ids. This works around a known defect in mail client applications
+such as MS Outlook, and may also prevent interoperability issues
+with other MTAs.
+.PP
+Example:
+.na
+.nf
+.in +4
+.nf
+.na
+.ft C
+ smtpd_tls_always_issue_session_ids = no
+.fi
+.ad
+.ft R
+.in -4
+.fi
+.ad
+.PP
+This feature is available in Postfix 2.3 and later.
.SH smtpd_tls_ask_ccert (default: no)
Ask a remote SMTP client for a client certificate. This
information is needed for certificate based mail relaying with,
server's list of offered SASL mechanisms.
.PP
Available in Postfix version 2.3 and later:
-.IP "\fBsmtp_sasl_auth_enforce (yes)\fR"
-If sender-dependent SASL passwords are turned off, defer mail
-delivery when an SMTP server does not support SASL authentication,
-while smtp_sasl_password_maps contains SASL login/password information
-for that server.
.IP "\fBsmtp_sender_dependent_authentication (no)\fR"
Enable sender-dependent authentication in the Postfix SMTP client; this is
available only with SASL authentication, and disables SMTP connection
.IP "\fBsmtp_tls_note_starttls_offer (no)\fR"
Log the hostname of a remote SMTP server that offers STARTTLS,
when TLS is not already enabled for that server.
+.IP "\fBsmtp_tls_policy_maps (empty)\fR"
+Optional lookup tables with the Postfix SMTP client TLS security
+policy by next-hop destination; when a non-empty value is specified,
+this overrides the obsolete smtp_tls_per_site parameter.
+.IP "\fBsmtp_tls_mandatory_protocols (SSLv3, TLSv1)\fR"
+List of TLS protocols that the Postfix SMTP client will use
+with mandatory TLS encryption.
.IP "\fBsmtp_tls_scert_verifydepth (5)\fR"
The verification depth for remote SMTP server certificates.
.IP "\fBsmtp_tls_secure_cert_match (nexthop, dot-nexthop)\fR"
.IP "\fBsmtpd_delay_open_until_valid_rcpt (yes)\fR"
Postpone the start of an SMTP mail transaction until a valid
RCPT TO command is received.
+.PP
+Available in Postfix version 2.3 and later:
+.IP "\fBsmtpd_tls_always_issue_session_ids (yes)\fR"
+Force the Postfix SMTP server to issue a TLS session id, even
+when TLS session caching is turned off (smtpd_tls_session_cache_database
+is empty).
.SH "ADDRESS REWRITING CONTROLS"
.na
.nf
.IP "\fBsmtpd_tls_CAfile (empty)\fR"
The file with the certificate of the certification authority
(CA) that issued the Postfix SMTP server certificate.
+.IP "\fBsmtpd_tls_always_issue_session_ids (yes)\fR"
+Force the Postfix SMTP server to issue a TLS session id, even
+when TLS session caching is turned off (smtpd_tls_session_cache_database
+is empty).
.IP "\fBsmtpd_tls_ask_ccert (no)\fR"
Ask a remote SMTP client for a client certificate.
.IP "\fBsmtpd_tls_auth_only (no)\fR"
.PP
Available in Postfix version 2.3 and later:
.IP "\fBsmtpd_peername_lookup (yes)\fR"
-Attempt to look up the Postfix SMTP client hostname, and verify that
+Attempt to look up the remote SMTP client hostname, and verify that
the name matches the client IP address.
.PP
The per SMTP client connection count and request rate limits are
s;\blmtp_rcpt_timeout\b;<a href="postconf.5.html#lmtp_rcpt_timeout">$&</a>;g;
s;\blmtp_rset_timeout\b;<a href="postconf.5.html#lmtp_rset_timeout">$&</a>;g;
s;\blmtp_sasl_auth_enable\b;<a href="postconf.5.html#lmtp_sasl_auth_enable">$&</a>;g;
- s;\blmtp_sasl_auth_enforce\b;<a href="postconf.5.html#lmtp_sasl_auth_enforce">$&</a>;g;
s;\blmtp_sasl_password_maps\b;<a href="postconf.5.html#lmtp_sasl_password_maps">$&</a>;g;
s;\blmtp_sasl_security_options\b;<a href="postconf.5.html#lmtp_sasl_security_options">$&</a>;g;
s;\blmtp_sasl_type\b;<a href="postconf.5.html#lmtp_sasl_type">$&</a>;g;
s;\bsmtp_[-</Bb>]*\n* *[<Bb>]*sasl_[-</Bb>]*\n* *[<Bb>]*tls_[-</Bb>]*\n* *[<Bb>]*secu[-</Bb>]*\n* *[<Bb>]*rity_options\b;<a href="postconf.5.html#smtp_sasl_tls_security_options">$&</a>;g;
s;\bsmtp_sasl_tls_verified_secu[-</Bb>]*\n* *[<Bb>]*rity_options\b;<a href="postconf.5.html#smtp_sasl_tls_verified_security_options">$&</a>;g;
s;\bsmtp_sasl_type\b;<a href="postconf.5.html#smtp_sasl_type">$&</a>;g;
- s;\bsmtp_sasl_auth_enforce\b;<a href="postconf.5.html#smtp_sasl_auth_enforce">$&</a>;g;
s;\bsmtp_starttls_timeout\b;<a href="postconf.5.html#smtp_starttls_timeout">$&</a>;g;
s;\bsmtp_tls_CAfile\b;<a href="postconf.5.html#smtp_tls_CAfile">$&</a>;g;
s;\bsmtp_tls_CApath\b;<a href="postconf.5.html#smtp_tls_CApath">$&</a>;g;
s;\bsmtpd_tls_req_ccert\b;<a href="postconf.5.html#smtpd_tls_req_ccert">$&</a>;g;
s;\bsmtpd_tls_session_cache_database\b;<a href="postconf.5.html#smtpd_tls_session_cache_database">$&</a>;g;
s;\bsmtpd_tls_session_cache_timeout\b;<a href="postconf.5.html#smtpd_tls_session_cache_timeout">$&</a>;g;
+ s;\bsmtpd_tls_always_issue_session_ids\b;<a href="postconf.5.html#smtpd_tls_always_issue_session_ids">$&</a>;g;
s;\bsmtpd_tls_wrappermode\b;<a href="postconf.5.html#smtpd_tls_wrappermode">$&</a>;g;
s;\bsmtpd_use_tls\b;<a href="postconf.5.html#smtpd_use_tls">$&</a>;g;
s;\btls_daemon_random_bytes\b;<a href="postconf.5.html#tls_daemon_random_bytes">$&</a>;g;
the real client name IP address. See smtp(8) and XFORWARD_README
for more information. </p>
-<li> <p> With "-o disable_mime_output_conversion=yes", the scan
-delivery agent will not convert 8BITMIME mail to quoted-printable
-form while delivering to the content filter, as that would invalidate
-domainkeys and other digital signatures. This workaround is needed
-because some SMTP-based content filters don't announce 8BITMIME
-support, even though they can handle it just fine. </p>
+<li> <p> The "-o disable_mime_output_conversion=yes" is a workaround
+that prevents the breaking of domainkeys and other digital signatures.
+This is needed because some SMTP-based content filters don't announce
+8BITMIME support, even though they can handle it just fine. </p>
</ul>
<h2><a name="workarounds">Workarounds</a></h2>
<p> Content filters may break domain key etc. signatures. If you
-use an SMTP-based filter as described in FILTER_README, then you
-should add a line to master.cf with "disable_mime_output_conversion
-
= yes", as described in the <a
+use an SMTP-based content filter, then you should add a line to
+master.cf with "-o disable_mime_output_conversion=yes" (note: no
+
spaces around the "="), as described in the <a
href="FILTER_README.html#advanced_filter">advanced content filter</a>
example. </p>
<blockquote>
<pre>
-% make makefiles CCARGS='-DUSE_SASL_AUTH -DDEF_SASL_SERVER=\"dovecot\"'
+% make makefiles CCARGS='-DUSE_SASL_AUTH -DDEF_SASL_SERVER_TYPE=\"dovecot\"'
</pre>
</blockquote>
<ul>
-<li> <p> The "-DDEF_SASL_SERVER" stuff is not necessary; it just
+<li> <p> The "-DDEF_SASL_SERVER_TYPE" stuff is not necessary; it just
makes Postfix configuration a little more convenient because you
don't have to specify the SASL plug-in type in the Postfix main.cf
file. </p>
<p> It is strictly discouraged to use this mode from main.cf. If
you want to support this service, enable a special port in master.cf
-and specify "-o smtpd_tls_wrappermode = yes" as an smtpd(8) command
-line option. Port 465 (smtps) was once chosen for this feature.
+and specify "-o smtpd_tls_wrappermode=yes" (note: no space around
+the "=") as an smtpd(8) command line option. Port 465 (smtps) was
+once chosen for this feature.
</p>
<p> Example: </p>
</pre>
</blockquote>
+<p> When the Postfix SMTP server does not save TLS sessions to an
+external cache database, client-side session caching is unlikely
+to be useful. To prevent such wastage, the Postfix SMTP server can
+be configured to not issue TLS session ids. By default the Postfix
+SMTP server always issues TLS session ids. This works around known
+interoperability issues with some MUAs, and prevents possible
+interoperability issues with other MTAs. </p>
+
+<p> Example: </p>
+
+<blockquote>
+<pre>
+ smtpd_tls_always_issue_session_ids = no
+</pre>
+</blockquote>
+
<h3><a name="server_access">Server access control</a> </h3>
<p> Postfix TLS support introduces three additional features for
%PARAM smtpd_peername_lookup yes
-<p> Attempt to look up the Postfix SMTP client hostname, and verify that
+<p> Attempt to look up the remote SMTP client hostname, and verify that
the name matches the client IP address. A client name is set to
"unknown" when it cannot be looked up or verified, or when name
lookup is disabled. Turning off name lookup reduces delays due to
<p> This feature is available in Postfix 2.3 and later. </p>
-%PARAM smtp_sasl_auth_enforce yes
-
-<p> If sender-dependent SASL passwords are turned off, defer mail
-delivery when an SMTP server does not support SASL authentication,
-while smtp_sasl_password_maps contains SASL login/password information
-for that server. </p>
-
-<p> This feature is available in Postfix 2.3 and later. </p>
-
-%PARAM lmtp_sasl_auth_enforce yes
-
-<p> The LMTP-specific version of the smtp_sasl_auth_enforce
-configuration parameter. See there for details. </p>
-
-<p> This feature is available in Postfix 2.3 and later. </p>
-
%PARAM smtpd_tls_security_level
<p> The SMTP TLS security level for the Postfix SMTP server; when
Postfix-generated email messages. The user is warned. </p>
<p> This feature is available in Postfix 2.3 and later. </p>
+
+%PARAM smtpd_tls_always_issue_session_ids yes
+
+<p> Force the Postfix SMTP server to issue a TLS session id, even
+when TLS session caching is turned off (smtpd_tls_session_cache_database
+is empty). This behavior is compatible with Postfix < 2.3. </p>
+
+<p> With Postfix 2.3 and later the Postfix SMTP server can disable
+session id generation when TLS session caching is turned off. This
+keeps clients from caching sessions that almost certainly cannot
+be re-used. </p>
+
+<p> By default, the Postfix SMTP server always generates TLS session
+ids. This works around a known defect in mail client applications
+such as MS Outlook, and may also prevent interoperability issues
+with other MTAs. </p>
+
+<p> Example: </p>
+
+<blockquote>
+<pre>
+ smtpd_tls_always_issue_session_ids = no
+</pre>
+</blockquote>
+
+<p> This feature is available in Postfix 2.3 and later. </p>
MILTERS *milters; /* mail filters */
const char *client_name; /* real or ersatz client */
const char *client_addr; /* real or ersatz client */
+ int client_af; /* real or ersatz client */
+ const char *client_port; /* real or ersatz client */
} CLEANUP_STATE;
/*
if (msg_verbose)
msg_info("%s: %s", myname, resp);
+ /*
+ * Sanity check.
+ */
+ if (state->client_name == 0)
+ msg_panic("%s: missing client info initialization", myname);
+
/*
* We don't report errors that were already reported by the content
* editing call-back routines. See cleanup_milter_error() above.
return (ret);
}
+/* cleanup_milter_client_init - initialize real or ersatz client info */
+
+static void cleanup_milter_client_init(CLEANUP_STATE *state)
+{
+ const char *proto_attr;
+
+ /*
+ * Either the cleanup client specifies a name, address and protocol, or
+ * we have a local submission and pretend localhost/127.0.0.1/AF_INET.
+ */
+#define NO_CLIENT_PORT "0"
+
+ state->client_name = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_NAME);
+ state->client_addr = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_ADDR);
+ state->client_port = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_PORT);
+ proto_attr = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_AF);
+
+ if (state->client_name == 0 || state->client_addr == 0 || proto_attr == 0
+ || !alldig(proto_attr)) {
+ state->client_name = "localhost";
+ state->client_addr = "127.0.0.1";
+ state->client_af = AF_INET;
+ } else
+ state->client_af = atoi(proto_attr);
+ if (state->client_port == 0)
+ state->client_port = NO_CLIENT_PORT;
+}
+
/* cleanup_milter_inspect - run message through mail filter */
void cleanup_milter_inspect(CLEANUP_STATE *state, MILTERS *milters)
if (msg_verbose)
msg_info("enter %s", myname);
+ /*
+ * Initialize, in case we're called via smtpd(8).
+ */
+ if (state->client_name == 0)
+ cleanup_milter_client_init(state);
+
/*
* Process mail filter replies. The reply format is verified by the mail
* filter library.
const char *addr)
{
const char *resp;
- const char *proto_attr;
- const char *client_port;
- int client_af;
const char *helo;
const char *argv[2];
cleanup_ins_header, cleanup_del_header,
cleanup_add_rcpt, cleanup_del_rcpt,
cleanup_repl_body, (void *) state);
-
- /*
- * Either the cleanup client specifies a name, address and protocol, or
- * we have a local submission and pretend localhost/127.0.0.1/AF_INET.
- */
-#define NO_CLIENT_PORT "0"
-
- state->client_name = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_NAME);
- state->client_addr = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_ADDR);
-
- client_port = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_PORT);
- proto_attr = nvtable_find(state->attr, MAIL_ATTR_ACT_CLIENT_AF);
- if (state->client_name == 0 || state->client_addr == 0 || proto_attr == 0
- || !alldig(proto_attr)) {
- state->client_name = "localhost";
- state->client_addr = "127.0.0.1";
- client_af = AF_INET;
- } else
- client_af = atoi(proto_attr);
- if (client_port == 0)
- client_port = NO_CLIENT_PORT;
+ if (state->client_name == 0)
+ cleanup_milter_client_init(state);
/*
* Emulate SMTP events.
*/
if ((resp = milter_conn_event(milters, state->client_name, state->client_addr,
- client_port, client_af)) != 0) {
+ state->client_port, state->client_af)) != 0) {
cleanup_milter_apply(state, "CONNECT", resp);
return;
}
MILTERS *milters,
const char *addr)
{
+ const char *myname = "cleanup_milter_emul_rcpt";
const char *resp;
const char *argv[2];
+ /*
+ * Sanity check.
+ */
+ if (state->client_name == 0)
+ msg_panic("%s: missing client info initialization", myname);
+
/*
* CLEANUP_STAT_CONT and CLEANUP_STAT_DEFER both update the reason
* attribute, but CLEANUP_STAT_DEFER takes precedence. It terminates
void cleanup_milter_emul_data(CLEANUP_STATE *state, MILTERS *milters)
{
+ const char *myname = "cleanup_milter_emul_data";
const char *resp;
+ /*
+ * Sanity check.
+ */
+ if (state->client_name == 0)
+ msg_panic("%s: missing client info initialization", myname);
+
if ((resp = milter_data_event(milters)) != 0)
cleanup_milter_apply(state, "DATA", resp);
}
state->milters = 0;
state->client_name = 0;
state->client_addr = 0;
+ state->client_af = 0;
+ state->client_port = 0;
return (state);
}
#define DEF_SMTPD_TLS_SCACHTIME "3600s"
extern int var_smtpd_tls_scache_timeout;
+#define VAR_SMTPD_TLS_SET_SESSID "smtpd_tls_always_issue_session_ids"
+#define DEF_SMTPD_TLS_SET_SESSID 1
+extern bool var_smtpd_tls_set_sessid;
+
#define VAR_SMTPD_DELAY_OPEN "smtpd_delay_open_until_valid_rcpt"
#define DEF_SMTPD_DELAY_OPEN 1
extern bool var_smtpd_delay_open;
* Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only.
*/
-#define MAIL_RELEASE_DATE "20060711"
+#define MAIL_RELEASE_DATE "20060719"
#define MAIL_VERSION_NUMBER "2.4"
#ifdef SNAPSHOT
+# Reject with text
+./test-milter -C 1 -a "554 5.7.1 Rejected" -c connect -p inet:9999@127.0.0.1
+./test-milter -C 1 -a "554 5.7.1 Rejected" -c helo -p inet:9999@127.0.0.1
+./test-milter -C 1 -a "554 5.7.1 Rejected" -c mail -p inet:9999@127.0.0.1
+./test-milter -C 1 -a "554 5.7.1 Rejected" -c rcpt -p inet:9999@127.0.0.1
+./test-milter -C 1 -a "554 5.7.1 Rejected" -c header -p inet:9999@127.0.0.1
+./test-milter -C 1 -a "554 5.7.1 Rejected" -c eoh -p inet:9999@127.0.0.1
+./test-milter -C 1 -a "554 5.7.1 Rejected" -c body -p inet:9999@127.0.0.1
+./test-milter -C 1 -a "554 5.7.1 Rejected" -c eom -p inet:9999@127.0.0.1
+
# Tempfail tests
./test-milter -C 1 -a tempfail -c connect -p inet:9999@127.0.0.1
./test-milter -C 1 -a tempfail -c helo -p inet:9999@127.0.0.1
static char *reply_dsn;
static char *reply_message;
+#ifdef SMFIR_INSHEADER
static char *ins_hdr;
static int ins_idx;
static char *ins_val;
+#endif
+
+#ifdef SMFIR_CHGHEADER
static char *chg_hdr;
static int chg_idx;
static char *chg_val;
+#endif
+
static int test_reply(SMFICTX *ctx, int code)
{
- (void) fflush(stdout); /* In case output redirected. */
+ (void) fflush(stdout); /* In case output redirected. */
if (code == SMFIR_REPLYCODE) {
if (smfi_setreply(ctx, reply_code, reply_dsn, reply_message) != MI_SUCCESS)
static sfsistat test_eom(SMFICTX *ctx)
{
printf("test_eom\n");
+#ifdef SMFIR_INSHEADER
if (ins_hdr && smfi_insheader(ctx, ins_idx, ins_hdr, ins_val) == MI_FAILURE)
fprintf(stderr, "smfi_insheader failed");
+#endif
+#ifdef SMFIR_CHGHEADER
if (chg_hdr && smfi_chgheader(ctx, chg_hdr, chg_idx, chg_val) == MI_FAILURE)
fprintf(stderr, "smfi_chgheader failed");
+#endif
return (test_reply(ctx, test_eom_reply));
}
exit(1);
}
break;
+#ifdef SMFIR_INSHEADER
case 'i':
if (ins_hdr) {
fprintf(stderr, "too many -i options\n");
}
parse_hdr_info(optarg, &ins_idx, &ins_hdr, &ins_val);
break;
+#endif
case 'p':
if (smfi_setconn(optarg) == MI_FAILURE) {
fprintf(stderr, "smfi_setconn failed\n");
exit(1);
}
break;
+#ifdef SMFIR_CHGHEADER
case 'r':
if (chg_hdr) {
fprintf(stderr, "too many -r options\n");
}
parse_hdr_info(optarg, &chg_idx, &chg_hdr, &chg_val);
break;
+#endif
case 'v':
verbose++;
break;
/* P.O. Box 704
/* Yorktown Heights, NY 10598, USA
/*
+/* TLS support by:
+/* Lutz Jaenicke
+/* Brandenburg University of Technology
+/* Cottbus, Germany
+/*
+/* Victor Duchovni
+/* Morgan Stanley
+/*
/* SASL support originally by:
/* Till Franke
/* SuSE Rhein/Main AG
#endif
VAR_LMTP_SENDER_AUTH, DEF_LMTP_SENDER_AUTH, &var_smtp_sender_auth,
VAR_LMTP_CNAME_OVERR, DEF_LMTP_CNAME_OVERR, &var_smtp_cname_overr,
- VAR_LMTP_SASL_ENFORCE, DEF_LMTP_SASL_ENFORCE, &var_smtp_sasl_enforce,
0,
};
/* server's list of offered SASL mechanisms.
/* .PP
/* Available in Postfix version 2.3 and later:
-/* .IP "\fBsmtp_sasl_auth_enforce (yes)\fR"
-/* If sender-dependent SASL passwords are turned off, defer mail
-/* delivery when an SMTP server does not support SASL authentication,
-/* while smtp_sasl_password_maps contains SASL login/password information
-/* for that server.
/* .IP "\fBsmtp_sender_dependent_authentication (no)\fR"
/* Enable sender-dependent authentication in the Postfix SMTP client; this is
/* available only with SASL authentication, and disables SMTP connection
/* .IP "\fBsmtp_tls_note_starttls_offer (no)\fR"
/* Log the hostname of a remote SMTP server that offers STARTTLS,
/* when TLS is not already enabled for that server.
+/* .IP "\fBsmtp_tls_policy_maps (empty)\fR"
+/* Optional lookup tables with the Postfix SMTP client TLS security
+/* policy by next-hop destination; when a non-empty value is specified,
+/* this overrides the obsolete smtp_tls_per_site parameter.
+/* .IP "\fBsmtp_tls_mandatory_protocols (SSLv3, TLSv1)\fR"
+/* List of TLS protocols that the Postfix SMTP client will use
+/* with mandatory TLS encryption.
/* .IP "\fBsmtp_tls_scert_verifydepth (5)\fR"
/* The verification depth for remote SMTP server certificates.
/* .IP "\fBsmtp_tls_secure_cert_match (nexthop, dot-nexthop)\fR"
char *var_lmtp_tcp_port;
int var_scache_proto_tmout;
bool var_smtp_cname_overr;
-bool var_smtp_sasl_enforce;
/*
* Global variables.
#endif
VAR_SMTP_SENDER_AUTH, DEF_SMTP_SENDER_AUTH, &var_smtp_sender_auth,
VAR_SMTP_CNAME_OVERR, DEF_SMTP_CNAME_OVERR, &var_smtp_cname_overr,
- VAR_SMTP_SASL_ENFORCE, DEF_SMTP_SASL_ENFORCE, &var_smtp_sasl_enforce,
0,
};
"host %s refused to talk to me: %s",
session->namaddr,
translit(resp->str, "\n", " ")));
- return (0);
}
} else {
where = "performing the LHLO handshake";
}
/*
- * Determine what server EHLO keywords to ignore, typically to avoid
- * inter-operability problems.
+ * No early returns allowed, to ensure consistent handling of TLS and
+ * SASL policies.
*/
- if (smtp_ehlo_dis_maps == 0
- || (ehlo_words = maps_find(smtp_ehlo_dis_maps, state->session->addr, 0)) == 0)
- ehlo_words = var_smtp_ehlo_dis_words;
- discard_mask = ehlo_mask(ehlo_words);
- if (discard_mask && !(discard_mask & EHLO_MASK_SILENT))
- msg_info("discarding EHLO keywords: %s", str_ehlo_mask(discard_mask));
+ if (session->features & SMTP_FEATURE_ESMTP) {
- /*
- * Pick up some useful features offered by the SMTP server. XXX Until we
- * have a portable routine to convert from string to off_t with proper
- * overflow detection, ignore the message size limit advertised by the
- * SMTP server. Otherwise, we might do the wrong thing when the server
- * advertises a really huge message size limit.
- *
- * XXX Allow for "code (SP|-) ehlo-keyword (SP|=) ehlo-param...", because
- * MicroSoft implemented AUTH based on an old draft.
- */
- lines = resp->str;
- for (n = 0; (words = mystrtok(&lines, "\n")) != 0; /* see below */ ) {
- if (mystrtok(&words, "- ") && (word = mystrtok(&words, " \t=")) != 0) {
- if (n == 0) {
- if (session->helo != 0)
- myfree(session->helo);
+ /*
+ * Determine what server EHLO keywords to ignore, typically to avoid
+ * inter-operability problems.
+ */
+ if (smtp_ehlo_dis_maps == 0
+ || (ehlo_words = maps_find(smtp_ehlo_dis_maps,
+ state->session->addr, 0)) == 0)
+ ehlo_words = var_smtp_ehlo_dis_words;
+ discard_mask = ehlo_mask(ehlo_words);
+ if (discard_mask && !(discard_mask & EHLO_MASK_SILENT))
+ msg_info("discarding EHLO keywords: %s",
+ str_ehlo_mask(discard_mask));
- /*
- * XXX: Keep the original case: we don't expect a single SMTP
- * server to randomly change the case of its helo response.
- * If different capitalization is detected, we should assume
- * disjoint TLS caches.
- */
- session->helo = mystrdup(word);
- if (strcasecmp(word, var_myhostname) == 0
- && (state->misc_flags & SMTP_MISC_FLAG_LOOP_DETECT) != 0) {
- msg_warn("host %s replied to HELO/EHLO with my own hostname %s",
- session->namaddrport, var_myhostname);
- if (session->features & SMTP_FEATURE_BEST_MX)
- return (smtp_site_fail(state, DSN_BY_LOCAL_MTA,
+ /*
+ * Pick up some useful features offered by the SMTP server. XXX Until
+ * we have a portable routine to convert from string to off_t with
+ * proper overflow detection, ignore the message size limit
+ * advertised by the SMTP server. Otherwise, we might do the wrong
+ * thing when the server advertises a really huge message size limit.
+ *
+ * XXX Allow for "code (SP|-) ehlo-keyword (SP|=) ehlo-param...",
+ * because MicroSoft implemented AUTH based on an old draft.
+ */
+ lines = resp->str;
+ for (n = 0; (words = mystrtok(&lines, "\n")) != 0; /* see below */ ) {
+ if (mystrtok(&words, "- ")
+ && (word = mystrtok(&words, " \t=")) != 0) {
+ if (n == 0) {
+ if (session->helo != 0)
+ myfree(session->helo);
+
+ /*
+ * XXX: Keep the original case: we don't expect a single
+ * SMTP server to randomly change the case of its helo
+ * response. If different capitalization is detected, we
+ * should assume disjoint TLS caches.
+ */
+ session->helo = mystrdup(word);
+ if (strcasecmp(word, var_myhostname) == 0
+ && (state->misc_flags & SMTP_MISC_FLAG_LOOP_DETECT) != 0) {
+ msg_warn("host %s replied to HELO/EHLO"
+ " with my own hostname %s",
+ session->namaddrport, var_myhostname);
+ if (session->features & SMTP_FEATURE_BEST_MX)
+ return (smtp_site_fail(state, DSN_BY_LOCAL_MTA,
SMTP_RESP_FAKE(&fake, "5.4.6"),
"mail for %s loops back to myself",
- request->nexthop));
- else
- return (smtp_site_fail(state, DSN_BY_LOCAL_MTA,
+ request->nexthop));
+ else
+ return (smtp_site_fail(state, DSN_BY_LOCAL_MTA,
SMTP_RESP_FAKE(&fake, "4.4.6"),
"mail for %s loops back to myself",
- request->nexthop));
- }
- } else if (strcasecmp(word, "8BITMIME") == 0) {
- if ((discard_mask & EHLO_MASK_8BITMIME) == 0)
- session->features |= SMTP_FEATURE_8BITMIME;
- } else if (strcasecmp(word, "PIPELINING") == 0) {
- if ((discard_mask & EHLO_MASK_PIPELINING) == 0)
- session->features |= SMTP_FEATURE_PIPELINING;
- } else if (strcasecmp(word, "XFORWARD") == 0) {
- if ((discard_mask & EHLO_MASK_XFORWARD) == 0)
- while ((word = mystrtok(&words, " \t")) != 0)
- session->features |= name_code(xforward_features,
- NAME_CODE_FLAG_NONE, word);
- } else if (strcasecmp(word, "SIZE") == 0) {
- if ((discard_mask & EHLO_MASK_SIZE) == 0) {
- session->features |= SMTP_FEATURE_SIZE;
- if ((word = mystrtok(&words, " \t")) != 0) {
- if (!alldig(word))
- msg_warn("bad EHLO SIZE limit \"%s\" from %s",
- word, session->namaddrport);
- else
- session->size_limit = off_cvt_string(word);
+ request->nexthop));
+ }
+ } else if (strcasecmp(word, "8BITMIME") == 0) {
+ if ((discard_mask & EHLO_MASK_8BITMIME) == 0)
+ session->features |= SMTP_FEATURE_8BITMIME;
+ } else if (strcasecmp(word, "PIPELINING") == 0) {
+ if ((discard_mask & EHLO_MASK_PIPELINING) == 0)
+ session->features |= SMTP_FEATURE_PIPELINING;
+ } else if (strcasecmp(word, "XFORWARD") == 0) {
+ if ((discard_mask & EHLO_MASK_XFORWARD) == 0)
+ while ((word = mystrtok(&words, " \t")) != 0)
+ session->features |=
+ name_code(xforward_features,
+ NAME_CODE_FLAG_NONE, word);
+ } else if (strcasecmp(word, "SIZE") == 0) {
+ if ((discard_mask & EHLO_MASK_SIZE) == 0) {
+ session->features |= SMTP_FEATURE_SIZE;
+ if ((word = mystrtok(&words, " \t")) != 0) {
+ if (!alldig(word))
+ msg_warn("bad EHLO SIZE limit \"%s\" from %s",
+ word, session->namaddrport);
+ else
+ session->size_limit = off_cvt_string(word);
+ }
}
- }
#ifdef USE_TLS
- } else if (strcasecmp(word, "STARTTLS") == 0) {
- /* Ignored later if we already sent STARTTLS. */
- if ((discard_mask & EHLO_MASK_STARTTLS) == 0)
- session->features |= SMTP_FEATURE_STARTTLS;
+ } else if (strcasecmp(word, "STARTTLS") == 0) {
+ /* Ignored later if we already sent STARTTLS. */
+ if ((discard_mask & EHLO_MASK_STARTTLS) == 0)
+ session->features |= SMTP_FEATURE_STARTTLS;
#endif
#ifdef USE_SASL_AUTH
- } else if (var_smtp_sasl_enable && strcasecmp(word, "AUTH") == 0) {
- if ((discard_mask & EHLO_MASK_AUTH) == 0)
- smtp_sasl_helo_auth(session, words);
+ } else if (var_smtp_sasl_enable
+ && strcasecmp(word, "AUTH") == 0) {
+ if ((discard_mask & EHLO_MASK_AUTH) == 0)
+ smtp_sasl_helo_auth(session, words);
#endif
- } else if (strcasecmp(word, "DSN") == 0) {
- if ((discard_mask & EHLO_MASK_DSN) == 0)
- session->features |= SMTP_FEATURE_DSN;
+ } else if (strcasecmp(word, "DSN") == 0) {
+ if ((discard_mask & EHLO_MASK_DSN) == 0)
+ session->features |= SMTP_FEATURE_DSN;
+ }
+ n++;
}
- n++;
}
}
if (msg_verbose)
#ifdef USE_SASL_AUTH
if (var_smtp_sasl_enable && (session->features & SMTP_FEATURE_AUTH))
return (smtp_sasl_helo_login(state));
- else if (var_smtp_sasl_enable
- && *var_smtp_sasl_passwd
- && !var_smtp_sender_auth
- && var_smtp_sasl_enforce
- && smtp_sasl_passwd_lookup(session) != 0)
- return (smtp_site_fail(state, DSN_BY_LOCAL_MTA,
- SMTP_RESP_FAKE(&fake, "4.7.0"),
- "SASL login/password exists, but host %s "
- "does not announce SASL authentication support",
- session->namaddr));
#endif
return (0);
DONT_USE_DEAD_SESSION;
/*
- * If TLS is optional, try again, this time without TLS.
- * Specifically, this session is not final, don't defer any
- * recipients yet.
+ * If TLS is optional, try delivery to the same server over a
+ * plaintext connection. Otherwise we would defer mail forever with
+ * destinations that have no alternate MX host.
+ *
+ * Don't fall back to plaintext if we were willing to use SASL-over-TLS
+ * authentication. If the server doesn't announce SASL support over
+ * plaintext connections, then we don't want delivery to fail with
+ * "relay access denied".
*/
- if (session->tls_level == TLS_LEV_MAY)
+ if (session->tls_level == TLS_LEV_MAY
+#ifdef USE_SASL_AUTH
+ && !(var_smtp_sasl_enable
+ && *var_smtp_sasl_passwd
+ && smtp_sasl_passwd_lookup(session))
+#endif
+ )
RETRY_AS_PLAINTEXT;
return (smtp_site_fail(state, DSN_BY_LOCAL_MTA,
SMTP_RESP_FAKE(&fake, "4.7.5"),
&& (value = mail_addr_find(smtp_sasl_passwd_map,
state->request->sender, (char **) 0)) != 0)
|| (value = maps_find(smtp_sasl_passwd_map, session->host, 0)) != 0
- || (value = maps_find(smtp_sasl_passwd_map, session->dest, 0)) != 0) {
+ || (value = maps_find(smtp_sasl_passwd_map, session->dest, 0)) != 0) {
+ if (session->sasl_username)
+ myfree(session->sasl_username);
session->sasl_username = mystrdup(value);
passwd = split_at(session->sasl_username, ':');
+ if (session->sasl_passwd)
+ myfree(session->sasl_passwd);
session->sasl_passwd = mystrdup(passwd ? passwd : "");
if (msg_verbose)
msg_info("%s: host `%s' user `%s' pass `%s'",
/* .IP "\fBsmtpd_delay_open_until_valid_rcpt (yes)\fR"
/* Postpone the start of an SMTP mail transaction until a valid
/* RCPT TO command is received.
+/* .PP
+/* Available in Postfix version 2.3 and later:
+/* .IP "\fBsmtpd_tls_always_issue_session_ids (yes)\fR"
+/* Force the Postfix SMTP server to issue a TLS session id, even
+/* when TLS session caching is turned off (smtpd_tls_session_cache_database
+/* is empty).
/* ADDRESS REWRITING CONTROLS
/* .ad
/* .fi
/* .IP "\fBsmtpd_tls_CAfile (empty)\fR"
/* The file with the certificate of the certification authority
/* (CA) that issued the Postfix SMTP server certificate.
+/* .IP "\fBsmtpd_tls_always_issue_session_ids (yes)\fR"
+/* Force the Postfix SMTP server to issue a TLS session id, even
+/* when TLS session caching is turned off (smtpd_tls_session_cache_database
+/* is empty).
/* .IP "\fBsmtpd_tls_ask_ccert (no)\fR"
/* Ask a remote SMTP client for a client certificate.
/* .IP "\fBsmtpd_tls_auth_only (no)\fR"
/* .PP
/* Available in Postfix version 2.3 and later:
/* .IP "\fBsmtpd_peername_lookup (yes)\fR"
-/* Attempt to look up the Postfix SMTP client hostname, and verify that
+/* Attempt to look up the remote SMTP client hostname, and verify that
/* the name matches the client IP address.
/* .PP
/* The per SMTP client connection count and request rate limits are
bool var_smtpd_tls_received_header;
bool var_smtpd_tls_req_ccert;
int var_smtpd_tls_scache_timeout;
+bool var_smtpd_tls_set_sessid;
int var_tls_daemon_rand_bytes;
#endif
if (state->helo_name) {
myfree(state->helo_name);
state->helo_name = 0;
- if (smtpd_milters)
+ if (SMTPD_STAND_ALONE(state) == 0 && smtpd_milters != 0)
milter_abort(smtpd_milters);
}
}
props.verifydepth = var_smtpd_tls_ccert_vd;
props.cache_type = TLS_MGR_SCACHE_SMTPD;
props.scache_timeout = var_smtpd_tls_scache_timeout;
+ props.set_sessid = var_smtpd_tls_set_sessid;
props.cert_file = var_smtpd_tls_cert_file;
props.key_file = var_smtpd_tls_key_file;
props.dcert_file = var_smtpd_tls_dcert_file;
msg_warn("Can't require client certs unless TLS is required");
props.cipherlist =
- tls_cipher_list(enforce_tls ?
- tls_cipher_level(var_smtpd_tls_mand_ciph) :
- TLS_CIPHER_EXPORT,
+ tls_cipher_list(enforce_tls ?
+ tls_cipher_level(var_smtpd_tls_mand_ciph) :
+ TLS_CIPHER_EXPORT,
var_smtpd_tls_excl_ciph,
havecert ? "" : "aRSA aDSS",
wantcert ? "aNULL" : "",
- enforce_tls ? var_smtpd_tls_mand_excl :
- TLS_END_EXCLUDE,
+ enforce_tls ? var_smtpd_tls_mand_excl :
+ TLS_END_EXCLUDE,
TLS_END_EXCLUDE);
if (props.cipherlist == 0) {
var_smtpd_tls_excl_ciph,
havecert ? "" : "aRSA aDSS",
wantcert ? "aNULL" : "",
- enforce_tls ? var_smtpd_tls_mand_excl :
- TLS_END_EXCLUDE,
+ enforce_tls ? var_smtpd_tls_mand_excl :
+ TLS_END_EXCLUDE,
TLS_END_EXCLUDE);
}
if (havecert || oknocert)
VAR_SMTPD_TLS_ACERT, DEF_SMTPD_TLS_ACERT, &var_smtpd_tls_ask_ccert,
VAR_SMTPD_TLS_RCERT, DEF_SMTPD_TLS_RCERT, &var_smtpd_tls_req_ccert,
VAR_SMTPD_TLS_RECHEAD, DEF_SMTPD_TLS_RECHEAD, &var_smtpd_tls_received_header,
+ VAR_SMTPD_TLS_SET_SESSID, DEF_SMTPD_TLS_SET_SESSID, &var_smtpd_tls_set_sessid,
#endif
VAR_SMTPD_PEERNAME_LOOKUP, DEF_SMTPD_PEERNAME_LOOKUP, &var_smtpd_peername_lookup,
VAR_SMTPD_DELAY_OPEN, DEF_SMTPD_DELAY_OPEN, &var_smtpd_delay_open,
#include <name_code.h>
/*
- * TLS enforcement levels. Non-sentinel values also be used to indicate
+ * TLS enforcement levels. Non-sentinel values may also be used to indicate
* the actual security level of a session.
*/
#define TLS_LEV_NOTFOUND -1 /* sentinel */
int verifydepth;
const char *cache_type;
long scache_timeout;
+ int set_sessid;
const char *cert_file;
const char *key_file;
const char *dcert_file;
tls_print_errors();
cachable = 0;
}
- if (cachable) {
+ if (cachable || props->set_sessid) {
/*
* Initialize the session cache.
SSL_CTX_set_session_cache_mode(server_ctx,
SSL_SESS_CACHE_SERVER |
SSL_SESS_CACHE_NO_AUTO_CLEAR);
- SSL_CTX_sess_set_get_cb(server_ctx, get_server_session_cb);
- SSL_CTX_sess_set_new_cb(server_ctx, new_server_session_cb);
+ if (cachable) {
+ SSL_CTX_sess_set_get_cb(server_ctx, get_server_session_cb);
+ SSL_CTX_sess_set_new_cb(server_ctx, new_server_session_cb);
+ }
/*
* OpenSSL ignores timed-out sessions. We need to set the internal
projects / thirdparty / postfix.git / commitdiff
