postfix-3.10.3

diff --git a/postfix/HISTORY b/postfix/HISTORY
index a321a55b2590280a4025cc8c8510e13b54a6fca5..6206bed1638de293b8f7d72ff41974bec5cac6b6 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -29029,3 +29029,28 @@ Apologies for any names omitted.
        add an extra newline character before appending the new
        setting, causing information to become garbled. Fix by
        Michael Tokarev. File: postconf/postconf_edit.c.
+
+20250619
+
+       Bugfix (defect introduced: Postfix-3.10, date 20250117):
+       include the current TLS security level in the SMTP connection
+       cache lookup key for lookups by next-hop destination. The
+       idea is that to deliver a message without "TLS-Required:
+       no" header, the Postfix SMTP client must not reuse a
+       connection that was created during a burst of deliveries
+       of messages with "TLS-Required: no" to the same destination.
+
+       Including the TLS security level in the SMTP connection
+       cache lookup key will also prevent false connection reuse
+       when any future feature is added that overrides the TLS
+       security level based on message content or envelope metadata.
+       Files: smtp/smtp.h.
+
+       Likewise, include the current TLS security level in the TLS
+       client serverid field. File: smtp/smtp_proto.c.
+
+       Bugfix (defect introduced: Postfix-3.10, date 20250117): the
+       Postfix SMTP client attempted to look up TLSA records even
+       with "TLS-Required: no". This could result in unnecessary
+       failures. Fix by Viktor Dukhovni & Wietse. Files: smtp/smtp.h,
+       smtp/smtp_policy.c, smtp/smtp_connect.c.

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 3bf92b2c569dfe276a2c9a7447ab4a7706870f03..81a59fc3762c6aa665b4affc211025f429fa4400 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20250422"
-#define MAIL_VERSION_NUMBER    "3.10.2"
+#define MAIL_RELEASE_DATE      "20250710"
+#define MAIL_VERSION_NUMBER    "3.10.3"
 
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE      "-" MAIL_RELEASE_DATE

diff --git a/postfix/src/smtp/smtp.h b/postfix/src/smtp/smtp.h
index 8c5ee0a0f944f39abc14567bfb83997901850b1a..7214661a64ad12d6748be484b4936a16a219e8ca 100644 (file)
--- a/postfix/src/smtp/smtp.h
+++ b/postfix/src/smtp/smtp.h
@@ -59,6 +59,9 @@ typedef struct SMTP_ITERATOR {
     VSTRING *host;                     /* hostname or empty */
     VSTRING *addr;                     /* printable address or empty */
     unsigned port;                     /* network byte order or null */
+#ifdef USE_TLS
+    int     tlsreqno;                  /* "TLS-Required: no" */
+#endif
     struct DNS_RR *rr;                 /* DNS resource record or null */
     struct DNS_RR *mx;                 /* DNS resource record or null */
     /* Private members. */
@@ -66,11 +69,18 @@ typedef struct SMTP_ITERATOR {
     struct SMTP_STATE *parent;         /* parent linkage */
 } SMTP_ITERATOR;
 
+#ifdef USE_TLS
+#define IF_USE_TLS(...) (__VA_ARGS__)
+#else
+#define IF_USE_TLS(...)
+#endif
+
 #define SMTP_ITER_INIT(iter, _dest, _host, _addr, _port, state) do { \
        vstring_strcpy((iter)->dest, (_dest)); \
        vstring_strcpy((iter)->host, (_host)); \
        vstring_strcpy((iter)->addr, (_addr)); \
        (iter)->port = (_port); \
+       IF_USE_TLS((iter)->tlsreqno = 0); \
        (iter)->mx = (iter)->rr = 0; \
        vstring_strcpy((iter)->saved_dest, ""); \
        (iter)->parent = (state); \
@@ -728,7 +738,7 @@ char   *smtp_key_prefix(VSTRING *, const char *, SMTP_ITERATOR *, int);
   */
 #define SMTP_KEY_MASK_SCACHE_DEST_LABEL \
        (SMTP_KEY_FLAG_SERVICE | COND_SASL_SMTP_KEY_FLAG_SENDER \
-       | SMTP_KEY_FLAG_REQ_NEXTHOP)
+       | SMTP_KEY_FLAG_REQ_NEXTHOP | SMTP_KEY_FLAG_TLS_LEVEL)
 
  /*
   * Connection-cache endpoint lookup key. The SENDER, CUR_NEXTHOP, HOSTNAME,

diff --git a/postfix/src/smtp/smtp_connect.c b/postfix/src/smtp/smtp_connect.c
index 2bfff1c93d0c675b14b795b6cee0c5f4c49eede9..e4b60791a582d8d8d92a8e28aad6b162340578cf 100644 (file)
--- a/postfix/src/smtp/smtp_connect.c
+++ b/postfix/src/smtp/smtp_connect.c
@@ -507,6 +507,24 @@ static int smtp_get_effective_tls_level(DSN_BUF *why, SMTP_STATE *state)
     SMTP_ITERATOR *iter = state->iterator;
     SMTP_TLS_POLICY *tls = state->tls;
 
+    /*
+     * If the message contains a "TLS-Required: no" header, update the
+     * iterator to limit the policy at TLS_LEV_MAY.
+     * 
+     * We must do this early to avoid possible failure if TLSA record lookups
+     * fail, or if TLSA records are found, but can't be activated because the
+     * security level has been reset to "may".
+     * 
+     * Note that the REQUIRETLS verb in ESMTP overrides the "TLS-Required: no"
+     * header.
+     */
+#ifdef USE_TLS
+    if (var_tls_required_enable
+       && (state->request->sendopts & SOPT_REQUIRETLS_HEADER)) {
+       iter->tlsreqno = 1;
+    }
+#endif
+
     /*
      * Determine the TLS level for this destination.
      */
@@ -529,16 +547,6 @@ static int smtp_get_effective_tls_level(DSN_BUF *why, SMTP_STATE *state)
     }
 #endif
 
-    /*
-     * Otherwise, if the TLS level is not TLS_LEV_NONE or some non-level, and
-     * the message contains a "TLS-Required: no" header, limit the level to
-     * TLS_LEV_MAY.
-     */
-    else if (var_tls_required_enable && tls->level > TLS_LEV_NONE
-            && (state->request->sendopts & SOPT_REQUIRETLS_HEADER)) {
-       tls->level = TLS_LEV_MAY;
-    }
-
     /*
      * Success.
      */

diff --git a/postfix/src/smtp/smtp_proto.c b/postfix/src/smtp/smtp_proto.c
index df2f7439168744bef388d88801bf52493c3a8cec..b8968637819ed93ea397d7a8e5a3dd7985b75a9e 100644 (file)
--- a/postfix/src/smtp/smtp_proto.c
+++ b/postfix/src/smtp/smtp_proto.c
@@ -926,13 +926,16 @@ static int smtp_start_tls(SMTP_STATE *state)
      * XXX: The TLS library will salt the serverid with further details of the
      * protocol and cipher requirements including the server ehlo response.
      * Deferring the helo to the digested suffix results in more predictable
-     * SSL session lookup key lengths.
+     * SSL session lookup key lengths. Add the current TLS security level to
+     * account for TLS level overrides based on message content or envelope
+     * metadata.
      */
     serverid = vstring_alloc(10);
     smtp_key_prefix(serverid, "&", state->iterator, SMTP_KEY_FLAG_SERVICE
                    | SMTP_KEY_FLAG_CUR_NEXTHOP /* With port */
                    | SMTP_KEY_FLAG_HOSTNAME
-                   | SMTP_KEY_FLAG_ADDR);
+                   | SMTP_KEY_FLAG_ADDR
+                   | SMTP_KEY_FLAG_TLS_LEVEL);
 
     if (state->tls->conn_reuse) {
        TLS_CLIENT_PARAMS tls_params;

diff --git a/postfix/src/smtp/smtp_tls_policy.c b/postfix/src/smtp/smtp_tls_policy.c
index 6122c2d7823a28b8e1faadbf563c5d16545a8b93..6b9ee66e6fdbf51910e345eb2b5c301e302592ba 100644 (file)
--- a/postfix/src/smtp/smtp_tls_policy.c
+++ b/postfix/src/smtp/smtp_tls_policy.c
@@ -651,7 +651,12 @@ static void *policy_create(const char *unused_key, void *context)
     tls->level = global_tls_level();
     site_level = TLS_LEV_NOTFOUND;
 
-    if (tls_policy) {
+    if (iter->tlsreqno) {
+       if (msg_verbose)
+           msg_info("%s: no tls policy lookup", __func__);
+       if (tls->level > TLS_LEV_MAY)
+           tls->level = TLS_LEV_MAY;
+    } else if (tls_policy) {
        tls_policy_lookup(tls, &site_level, dest, "next-hop destination");
     } else if (tls_per_site) {
        tls_site_lookup(tls, &site_level, dest, "next-hop destination");