From: Wietse Venema Date: Mon, 4 Feb 2013 05:00:00 +0000 (-0500) Subject: postfix-2.10-20130204 X-Git-Tag: v2.10.0-RC1~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=96c5d8ba1013112fdbe5c2e71a0cb82d02689727;p=thirdparty%2Fpostfix.git postfix-2.10-20130204 --- diff --git a/postfix/HISTORY b/postfix/HISTORY index f11bb5588..b3b1a2834 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -18231,3 +18231,14 @@ Apologies for any names omitted. Bugfix: the local(8) delivery agent dereferenced a null pointer while delivering to null command (for example, "|" in a .forward file). Reported by Gilles Chehade. + +20130203 + + Bugfix: the undocumented OpenSSL X509_pubkey_digest() + function is unsuitable for computing certificate PUBLIC KEY + fingerprints. Postfix now provides a correct procedure + that accounts for the algorithm and parameters in addition + to the key data. Specify "tls_legacy_public_key_fingerprints + = yes" if you need backwards compatibility. Fix by Victor + Duchovni, BC added by Wietse. Files: tls/tls_verify.c, + tls/tls_misc.c, proto/TLS_README.html, global/mail_params.h. diff --git a/postfix/README_FILES/TLS_README b/postfix/README_FILES/TLS_README index 4694f931f..893b2c95b 100644 --- a/postfix/README_FILES/TLS_README +++ b/postfix/README_FILES/TLS_README @@ -473,6 +473,34 @@ host: /etc/postfix/relay_clientcerts: D7:04:2F:A7:0B:8C:A5:21:FA:31:77:E1:41:8A:EE:80 lutzpc.at.home +To extract the public key fingerprint from an X.509 certificate, you need to +extract the public key from the certificate and compute the appropriate digest +of its DER (ASN.1) encoding. With OpenSSL the "-pubkey" option of the "x509" +command extracts the public key always in "PEM" format. We pipe the result to +another OpenSSL command that converts the key to DER and then to the "dgst" +command to compute the fingerprint. + +The actual command to transform the key to DER format depends on the version of +OpenSSL used. With OpenSSL 1.0.0 and later, the "pkey" command supports all key +types. With OpenSSL 0.9.8 and earlier, the key type is always RSA (nobody uses +DSA, and EC keys are not fully supported by 0.9.8), so the "rsa" command is +used. + + # OpenSSL 1.0 with all certificates and SHA-1 fingerprints. + $ openssl x509 -in cert.pem -noout -pubkey | + openssl pkey -pubin -outform DER | + openssl dgst -sha1 -c + (stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 + + # OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. + $ openssl x509 -in cert.pem -noout -pubkey | + openssl rsa -pubin -outform DER | + openssl dgst -md5 -c + (stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50 + +Note: Postfix 2.9.0-2.9.5 computed the public key fingerprint incorrectly. To +use public-key fingerprints, upgrade to Postfix 2.9.6 or later. + SSeerrvveerr--ssiiddee cciipphheerr ccoonnttrroollss The Postfix SMTP server supports 5 distinct cipher security levels as specified @@ -834,6 +862,34 @@ the example above, we show two matching fingerprints: match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 +To extract the public key fingerprint from an X.509 certificate, you need to +extract the public key from the certificate and compute the appropriate digest +of its DER (ASN.1) encoding. With OpenSSL the "-pubkey" option of the "x509" +command extracts the public key always in "PEM" format. We pipe the result to +another OpenSSL command that converts the key to DER and then to the "dgst" +command to compute the fingerprint. + +The actual command to transform the key to DER format depends on the version of +OpenSSL used. With OpenSSL 1.0.0 and later, the "pkey" command supports all key +types. With OpenSSL 0.9.8 and earlier, the key type is always RSA (nobody uses +DSA, and EC keys are not fully supported by 0.9.8), so the "rsa" command is +used. + + # OpenSSL 1.0 with all certificates and SHA-1 fingerprints. + $ openssl x509 -in cert.pem -noout -pubkey | + openssl pkey -pubin -outform DER | + openssl dgst -sha1 -c + (stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 + + # OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. + $ openssl x509 -in cert.pem -noout -pubkey | + openssl rsa -pubin -outform DER | + openssl dgst -md5 -c + (stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50 + +Note: Postfix 2.9.0-2.9.5 computed the public key fingerprint incorrectly. To +use public-key fingerprints, upgrade to Postfix 2.9.6 or later. + MMaannddaattoorryy sseerrvveerr cceerrttiiffiiccaattee vveerriiffiiccaattiioonn At the "verify" TLS security level, messages are sent only over TLS encrypted diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index eb9863799..ee9348357 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -1,10 +1,10 @@ -The stable Postfix release is called postfix-2.9.x where 2=major -release number, 9=minor release number, x=patchlevel. The stable +The stable Postfix release is called postfix-2.10.x where 2=major +release number, 10=minor release number, x=patchlevel. The stable release never changes except for patches that address bugs or emergencies. Patches change the patchlevel and the release date. New features are developed in snapshot releases. These are called -postfix-2.10-yyyymmdd where yyyymmdd is the release date (yyyy=year, +postfix-2.11-yyyymmdd where yyyymmdd is the release date (yyyy=year, mm=month, dd=day). Patches are never issued for snapshot releases; instead, a new snapshot is released. @@ -14,8 +14,38 @@ specifies the release date of a stable release or snapshot release. If you upgrade from Postfix 2.8 or earlier, read RELEASE_NOTES-2.9 before proceeding. -Major changes with snapshot 20130201 -==================================== +Incompatible changes with snapshot 20130203 +=========================================== + +Thanks to OpenSSL documentation, the Postfix 2.9.0..2.9.5 SMTP +client and server computed incorrect TLS certificate PUBLIC-KEY +fingerprints. Support for certificate PUBLIC-KEY finger prints +was introduced with Postfix 2.9; there is no known problem with the +certificate fingerprint algorithms available since Postfix 2.2. + +Certificate PUBLIC-KEY finger prints may be used in the Postfix +SMTP server (with "check_ccert_access") and in the Postfix SMTP +client (with the "fingerprint" security level). + +Specify "tls_legacy_public_key_fingerprints = yes" temporarily, +pending a migration from configuration files with incorrect Postfix +2.9.0..2.9.5 certificate PUBLIC-KEY finger prints, to the correct +fingerprints used by Postfix 2.9.6 and later. + +To compute the correct PUBLIC-KEY finger prints: + +# OpenSSL 1.0 with all certificates and SHA-1 fingerprints. +$ openssl x509 -in cert.pem -noout -pubkey | \ + openssl pkey -pubin -outform DER | \ + openssl dgst -sha1 -c + +# OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. +$ openssl x509 -in cert.pem -noout -pubkey | \ + openssl rsa -pubin -outform DER | \ + openssl dgst -md5 -c + +Incompatible changes with snapshot 20130201 +=========================================== The "postconf -Mn" feature is withdrawn, in favor of a better design that not only supports queries but also updates of named properties @@ -37,16 +67,13 @@ Major changes with snapshot 20121224 ==================================== The postconf command has been updated to make trouble-shooting (and -support) easier. In summary, use "postconf -Mnxf" and "postconf --nxf" to review master.cf and main.cf parameter settings with -expanded parameter values. +support) easier. In summary, use "postconf -Mxf" and "postconf -nxf" +to review master.cf and main.cf parameter settings with expanded +parameter values. - "postconf -x" now expands $name in main.cf and master.cf parameter values. -- "postconf -Mn" now shows services that have "-o name=value" - parameter settings in master.cf. - - postconf warns about attempts to modify a read-only parameter (process_name, process_id) in main.cf or master.cf. @@ -259,7 +286,8 @@ scripts. Major changes with snapshot 20120303 ==================================== -New control for "permit" logging in smtpd_mumble_restrictions. -Specify "smtpd_log_access_permit_actions = static:all" to log all -"permit"-style actions, or specify a list of explicit names. More -details are in the postconf(5) manpage. +New control for "permit" logging in smtpd_mumble_restrictions (by +default, the SMTP server logs "reject" actions but not "permit" +actions). Specify "smtpd_log_access_permit_actions = static:all" +to log all "permit"-style actions, or specify a list of explicit +action names. More details are in the postconf(5) manpage. diff --git a/postfix/html/TLS_README.html b/postfix/html/TLS_README.html index cea177f4a..aaeb6296f 100644 --- a/postfix/html/TLS_README.html +++ b/postfix/html/TLS_README.html @@ -690,6 +690,39 @@ the name of the user or host:

+

To extract the public key fingerprint from an X.509 certificate, +you need to extract the public key from the certificate and compute +the appropriate digest of its DER (ASN.1) encoding. With OpenSSL +the "-pubkey" option of the "x509" command extracts the public +key always in "PEM" format. We pipe the result to another OpenSSL +command that converts the key to DER and then to the "dgst" command +to compute the fingerprint.

+ +

The actual command to transform the key to DER format depends +on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the +"pkey" command supports all key types. With OpenSSL 0.9.8 and +earlier, the key type is always RSA (nobody uses DSA, and EC +keys are not fully supported by 0.9.8), so the "rsa" command is +used.

+
+
+# OpenSSL 1.0 with all certificates and SHA-1 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl pkey -pubin -outform DER |
+    openssl dgst -sha1 -c
+(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58
+
+# OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl rsa -pubin -outform DER |
+    openssl dgst -md5 -c
+(stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50
+
+
+

Note: Postfix 2.9.0–2.9.5 computed the public key +fingerprint incorrectly. To use public-key fingerprints, upgrade +to Postfix 2.9.6 or later.

+

Server-side cipher controls

The Postfix SMTP server supports 5 distinct cipher security levels @@ -1087,7 +1120,7 @@ required. The certificate trust chain, expiration date, ... are not checked. Instead, the smtp_tls_fingerprint_cert_match parameter or the "match" attribute in the policy table lists the remote SMTP server certificate fingerprint or -public key fingerprint (Postfix 2.9 and later). +public key fingerprint (Postfix 2.9 and later).

If certificate fingerprints are exchanged securely, this is the strongest, and least scalable security level. The administrator needs @@ -1149,6 +1182,39 @@ As in the example above, we show two matching fingerprints:

+

To extract the public key fingerprint from an X.509 certificate, +you need to extract the public key from the certificate and compute +the appropriate digest of its DER (ASN.1) encoding. With OpenSSL +the "-pubkey" option of the "x509" command extracts the public +key always in "PEM" format. We pipe the result to another OpenSSL +command that converts the key to DER and then to the "dgst" command +to compute the fingerprint.

+ +

The actual command to transform the key to DER format depends +on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the +"pkey" command supports all key types. With OpenSSL 0.9.8 and +earlier, the key type is always RSA (nobody uses DSA, and EC +keys are not fully supported by 0.9.8), so the "rsa" command is +used.

+
+
+# OpenSSL 1.0 with all certificates and SHA-1 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl pkey -pubin -outform DER |
+    openssl dgst -sha1 -c
+(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58
+
+# OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl rsa -pubin -outform DER |
+    openssl dgst -md5 -c
+(stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50
+
+
+

Note: Postfix 2.9.0–2.9.5 computed the public key +fingerprint incorrectly. To use public-key fingerprints, upgrade +to Postfix 2.9.6 or later.

+

Mandatory server certificate verification

At the "verify" TLS security level, messages are sent only over diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html index 3db2d3f10..6a23f9ba2 100644 --- a/postfix/html/postconf.5.html +++ b/postfix/html/postconf.5.html @@ -8548,6 +8548,10 @@ D7:04:2F:A7:0B:8C:A5:21:FA:31:77:E1:41:8A:EE:80 lutzpc.at.home

an appropriate access(5) policy for each client. See RESTRICTION_CLASS_README.

+

Note: Postfix 2.9.0–2.9.5 computed the public key +fingerprint incorrectly. To use public-key fingerprints, upgrade +to Postfix 2.9.6 or later.

+

This feature is available with Postfix version 2.2.

@@ -11038,11 +11042,47 @@ SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A -

Public key fingerprints are more difficult to extract, however, -the SHA-1 public key fingerprint is often present as the value of the -"Subject Key Identifier" extension in X.509v3 certificates. The Postfix -SMTP server and client log the peer certificate fingerprint and public -key fingerprint when TLS loglevel is 1 or higher.

+

To extract the public key fingerprint from an X.509 certificate, +you need to extract the public key from the certificate and compute +the appropriate digest of its DER (ASN.1) encoding. With OpenSSL +the "-pubkey" option of the "x509" command extracts the public +key always in "PEM" format. We pipe the result to another OpenSSL +command that converts the key to DER and then to the "dgst" command +to compute the fingerprint.

+ +

The actual command to transform the key to DER format depends +on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the +"pkey" command supports all key types. With OpenSSL 0.9.8 and +earlier, the key type is always RSA (nobody uses DSA, and EC +keys are not fully supported by 0.9.8), so the "rsa" command is +used.

+
+
+# OpenSSL 1.0 with all certificates and SHA-1 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl pkey -pubin -outform DER |
+    openssl dgst -sha1 -c
+(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58
+
+
+ +
+
+# OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl rsa -pubin -outform DER |
+    openssl dgst -md5 -c
+(stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50
+
+
+ +

The Postfix SMTP server and client log the peer (leaf) certificate +fingerprint and public key fingerprint when TLS loglevel is 1 or +higher.

+ +

Note: Postfix 2.9.0–2.9.5 computed the public key +fingerprint incorrectly. To use public-key fingerprints, upgrade +to Postfix 2.9.6 or later.

This feature is available in Postfix 2.5 and later.

@@ -13190,8 +13230,9 @@ always allows up to 100 junk commands by default.

(default: empty)

Enable logging of the named "permit" actions in SMTP server -access lists. This does not affect conditional actions such as -"defer_if_permit".

+access lists (by default, the SMTP server logs "reject" actions but +not "permit" actions). This feature does not affect conditional +actions such as "defer_if_permit".

Specify a list of "permit" action names, "/file/name" or "type:table" patterns, separated by commas and/or whitespace. The @@ -14975,11 +15016,47 @@ SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A -

Public key fingerprints are more difficult to extract, however, -the SHA-1 public key fingerprint is often present as the value of the -"Subject Key Identifier" extension in X.509v3 certificates. The Postfix -SMTP server and client log the peer certificate fingerprint and public -key fingerprint when TLS loglevel is 1 or higher.

+

To extract the public key fingerprint from an X.509 certificate, +you need to extract the public key from the certificate and compute +the appropriate digest of its DER (ASN.1) encoding. With OpenSSL +the "-pubkey" option of the "x509" command extracts the public +key always in "PEM" format. We pipe the result to another OpenSSL +command that converts the key to DER and then to the "dgst" command +to compute the fingerprint.

+ +

The actual command to transform the key to DER format depends +on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the +"pkey" command supports all key types. With OpenSSL 0.9.8 and +earlier, the key type is always RSA (nobody uses DSA, and EC +keys are not fully supported by 0.9.8), so the "rsa" command is +used.

+
+
+# OpenSSL 1.0 with all certificates and SHA-1 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl pkey -pubin -outform DER |
+    openssl dgst -sha1 -c
+(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58
+
+
+ +
+
+# OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl rsa -pubin -outform DER |
+    openssl dgst -md5 -c
+(stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50
+
+
+ +

The Postfix SMTP server and client log the peer (leaf) certificate +fingerprint and public key fingerprint when TLS loglevel is 1 or +higher.

+ +

Note: Postfix 2.9.0–2.9.5 computed the public key +fingerprint incorrectly. To use public-key fingerprints, upgrade +to Postfix 2.9.6 or later.

Example: client-certificate access table, with sha1 fingerprints:

@@ -15909,6 +15986,25 @@ OpenSSL releases.

This feature is available in Postfix 2.3 and later.

+
+ +
tls_legacy_public_key_fingerprints +(default: no)
+ +

A temporary migration aid for sites that use certificate +public-key fingerprints with Postfix 2.9.0..2.9.5, which use +an incorrect algorithm. This parameter has no effect on the certificate +fingerprint support that is available since Postfix 2.2.

+ +

Specify "tls_legacy_public_key_fingerprints = yes" temporarily, +pending a migration from configuration files with incorrect Postfix +2.9.0..2.9.5 certificate public-key finger prints, to the correct +fingerprints used by Postfix 2.9.6 and later. To compute the correct +certificate public-key fingerprints, see TLS_README.

+ +

This feature is available in Postfix 2.9.6 and later.

+ +
tls_low_cipherlist diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5 index 2c547b493..d2f6a7f1b 100644 --- a/postfix/man/man5/postconf.5 +++ b/postfix/man/man5/postconf.5 @@ -5143,6 +5143,10 @@ For more fine-grained control, use check_ccert_access to select an appropriate \fBaccess\fR(5) policy for each client. See RESTRICTION_CLASS_README. .PP +\fBNote:\fR Postfix 2.9.0–2.9.5 computed the public key +fingerprint incorrectly. To use public-key fingerprints, upgrade +to Postfix 2.9.6 or later. +.PP This feature is available with Postfix version 2.2. .SH relay_destination_concurrency_limit (default: $default_destination_concurrency_limit) The maximal number of parallel deliveries to the same destination @@ -6842,11 +6846,56 @@ SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A .ft R .in -4 .PP -Public key fingerprints are more difficult to extract, however, -the SHA-1 public key fingerprint is often present as the value of the -"Subject Key Identifier" extension in X.509v3 certificates. The Postfix -SMTP server and client log the peer certificate fingerprint and public -key fingerprint when TLS loglevel is 1 or higher. +To extract the public key fingerprint from an X.509 certificate, +you need to extract the public key from the certificate and compute +the appropriate digest of its DER (ASN.1) encoding. With OpenSSL +the "-pubkey" option of the "x509" command extracts the public +key always in "PEM" format. We pipe the result to another OpenSSL +command that converts the key to DER and then to the "dgst" command +to compute the fingerprint. +.PP +The actual command to transform the key to DER format depends +on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the +"pkey" command supports all key types. With OpenSSL 0.9.8 and +earlier, the key type is always RSA (nobody uses DSA, and EC +keys are not fully supported by 0.9.8), so the "rsa" command is +used. +.sp +.in +4 +.nf +.na +.ft C +# OpenSSL 1.0 with all certificates and SHA-1 fingerprints. +$ openssl x509 -in cert.pem -noout -pubkey | + openssl pkey -pubin -outform DER | + openssl dgst -sha1 -c +(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 +.fi +.ad +.ft R +.in -4 +.sp +.in +4 +.nf +.na +.ft C +# OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. +$ openssl x509 -in cert.pem -noout -pubkey | + openssl rsa -pubin -outform DER | + openssl dgst -md5 -c +(stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50 +.fi +.ad +.ft R +.in -4 +.PP +The Postfix SMTP server and client log the peer (leaf) certificate +fingerprint and public key fingerprint when TLS loglevel is 1 or +higher. +.PP +\fBNote:\fR Postfix 2.9.0–2.9.5 computed the public key +fingerprint incorrectly. To use public-key fingerprints, upgrade +to Postfix 2.9.6 or later. .PP This feature is available in Postfix 2.5 and later. .SH smtp_tls_key_file (default: $smtp_tls_cert_file) @@ -8617,8 +8666,9 @@ overload to just 1. With Postfix 2.5 and earlier, the SMTP server always allows up to 100 junk commands by default. .SH smtpd_log_access_permit_actions (default: empty) Enable logging of the named "permit" actions in SMTP server -access lists. This does not affect conditional actions such as -"defer_if_permit". +access lists (by default, the SMTP server logs "reject" actions but +not "permit" actions). This feature does not affect conditional +actions such as "defer_if_permit". .PP Specify a list of "permit" action names, "/file/name" or "type:table" patterns, separated by commas and/or whitespace. The @@ -10024,11 +10074,56 @@ SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A .ft R .in -4 .PP -Public key fingerprints are more difficult to extract, however, -the SHA-1 public key fingerprint is often present as the value of the -"Subject Key Identifier" extension in X.509v3 certificates. The Postfix -SMTP server and client log the peer certificate fingerprint and public -key fingerprint when TLS loglevel is 1 or higher. +To extract the public key fingerprint from an X.509 certificate, +you need to extract the public key from the certificate and compute +the appropriate digest of its DER (ASN.1) encoding. With OpenSSL +the "-pubkey" option of the "x509" command extracts the public +key always in "PEM" format. We pipe the result to another OpenSSL +command that converts the key to DER and then to the "dgst" command +to compute the fingerprint. +.PP +The actual command to transform the key to DER format depends +on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the +"pkey" command supports all key types. With OpenSSL 0.9.8 and +earlier, the key type is always RSA (nobody uses DSA, and EC +keys are not fully supported by 0.9.8), so the "rsa" command is +used. +.sp +.in +4 +.nf +.na +.ft C +# OpenSSL 1.0 with all certificates and SHA-1 fingerprints. +$ openssl x509 -in cert.pem -noout -pubkey | + openssl pkey -pubin -outform DER | + openssl dgst -sha1 -c +(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 +.fi +.ad +.ft R +.in -4 +.sp +.in +4 +.nf +.na +.ft C +# OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. +$ openssl x509 -in cert.pem -noout -pubkey | + openssl rsa -pubin -outform DER | + openssl dgst -md5 -c +(stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50 +.fi +.ad +.ft R +.in -4 +.PP +The Postfix SMTP server and client log the peer (leaf) certificate +fingerprint and public key fingerprint when TLS loglevel is 1 or +higher. +.PP +\fBNote:\fR Postfix 2.9.0–2.9.5 computed the public key +fingerprint incorrectly. To use public-key fingerprints, upgrade +to Postfix 2.9.6 or later. .PP Example: client-certificate access table, with sha1 fingerprints: .sp @@ -10727,6 +10822,19 @@ list when they are enabled. This prefix is not needed with previous OpenSSL releases. .PP This feature is available in Postfix 2.3 and later. +.SH tls_legacy_public_key_fingerprints (default: no) +A temporary migration aid for sites that use certificate +\fIpublic-key\fR fingerprints with Postfix 2.9.0..2.9.5, which use +an incorrect algorithm. This parameter has no effect on the certificate +fingerprint support that is available since Postfix 2.2. +.PP +Specify "tls_legacy_public_key_fingerprints = yes" temporarily, +pending a migration from configuration files with incorrect Postfix +2.9.0..2.9.5 certificate public-key finger prints, to the correct +fingerprints used by Postfix 2.9.6 and later. To compute the correct +certificate public-key fingerprints, see TLS_README. +.PP +This feature is available in Postfix 2.9.6 and later. .SH tls_low_cipherlist (default: ALL:!EXPORT:+RC4:@STRENGTH) The OpenSSL cipherlist for "LOW" or higher grade ciphers. This defines the meaning of the "low" setting in smtpd_tls_mandatory_ciphers, diff --git a/postfix/mantools/postlink b/postfix/mantools/postlink index 933c2361d..151866be1 100755 --- a/postfix/mantools/postlink +++ b/postfix/mantools/postlink @@ -693,6 +693,7 @@ while (<>) { s;\btls_preempt_cipherlist\b;$&;g; s;\btls_disable_workarounds\b;$&;g; s;\btls_append_default_CA\b;$&;g; + s;\btls_legacy_public_key_fingerprints\b;$&;g; s;\bfrozen_delivered_to\b;$&;g; s;\breset_owner_alias\b;$&;g; diff --git a/postfix/proto/TLS_README.html b/postfix/proto/TLS_README.html index f0b2f94f5..833e445d6 100644 --- a/postfix/proto/TLS_README.html +++ b/postfix/proto/TLS_README.html @@ -690,6 +690,39 @@ the name of the user or host:

+

To extract the public key fingerprint from an X.509 certificate, +you need to extract the public key from the certificate and compute +the appropriate digest of its DER (ASN.1) encoding. With OpenSSL +the "-pubkey" option of the "x509" command extracts the public +key always in "PEM" format. We pipe the result to another OpenSSL +command that converts the key to DER and then to the "dgst" command +to compute the fingerprint.

+ +

The actual command to transform the key to DER format depends +on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the +"pkey" command supports all key types. With OpenSSL 0.9.8 and +earlier, the key type is always RSA (nobody uses DSA, and EC +keys are not fully supported by 0.9.8), so the "rsa" command is +used.

+
+
+# OpenSSL 1.0 with all certificates and SHA-1 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl pkey -pubin -outform DER |
+    openssl dgst -sha1 -c
+(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58
+
+# OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl rsa -pubin -outform DER |
+    openssl dgst -md5 -c
+(stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50
+
+
+

Note: Postfix 2.9.0–2.9.5 computed the public key +fingerprint incorrectly. To use public-key fingerprints, upgrade +to Postfix 2.9.6 or later.

+

Server-side cipher controls

The Postfix SMTP server supports 5 distinct cipher security levels @@ -1087,7 +1120,7 @@ required. The certificate trust chain, expiration date, ... are not checked. Instead, the smtp_tls_fingerprint_cert_match parameter or the "match" attribute in the policy table lists the remote SMTP server certificate fingerprint or -public key fingerprint (Postfix 2.9 and later). +public key fingerprint (Postfix 2.9 and later).

If certificate fingerprints are exchanged securely, this is the strongest, and least scalable security level. The administrator needs @@ -1149,6 +1182,39 @@ As in the example above, we show two matching fingerprints:

+

To extract the public key fingerprint from an X.509 certificate, +you need to extract the public key from the certificate and compute +the appropriate digest of its DER (ASN.1) encoding. With OpenSSL +the "-pubkey" option of the "x509" command extracts the public +key always in "PEM" format. We pipe the result to another OpenSSL +command that converts the key to DER and then to the "dgst" command +to compute the fingerprint.

+ +

The actual command to transform the key to DER format depends +on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the +"pkey" command supports all key types. With OpenSSL 0.9.8 and +earlier, the key type is always RSA (nobody uses DSA, and EC +keys are not fully supported by 0.9.8), so the "rsa" command is +used.

+
+
+# OpenSSL 1.0 with all certificates and SHA-1 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl pkey -pubin -outform DER |
+    openssl dgst -sha1 -c
+(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58
+
+# OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl rsa -pubin -outform DER |
+    openssl dgst -md5 -c
+(stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50
+
+
+

Note: Postfix 2.9.0–2.9.5 computed the public key +fingerprint incorrectly. To use public-key fingerprints, upgrade +to Postfix 2.9.6 or later.

+

Mandatory server certificate verification

At the "verify" TLS security level, messages are sent only over diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto index 9283bc6a9..f88654b38 100644 --- a/postfix/proto/postconf.proto +++ b/postfix/proto/postconf.proto @@ -9257,6 +9257,10 @@ relay_clientcerts = hash:/etc/postfix/relay_clientcerts an appropriate access(5) policy for each client. See RESTRICTION_CLASS_README.

+

Note: Postfix 2.9.0–2.9.5 computed the public key +fingerprint incorrectly. To use public-key fingerprints, upgrade +to Postfix 2.9.6 or later.

+

This feature is available with Postfix version 2.2.

%PARAM smtpd_tls_cipherlist @@ -11689,11 +11693,47 @@ SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A -

Public key fingerprints are more difficult to extract, however, -the SHA-1 public key fingerprint is often present as the value of the -"Subject Key Identifier" extension in X.509v3 certificates. The Postfix -SMTP server and client log the peer certificate fingerprint and public -key fingerprint when TLS loglevel is 1 or higher.

+

To extract the public key fingerprint from an X.509 certificate, +you need to extract the public key from the certificate and compute +the appropriate digest of its DER (ASN.1) encoding. With OpenSSL +the "-pubkey" option of the "x509" command extracts the public +key always in "PEM" format. We pipe the result to another OpenSSL +command that converts the key to DER and then to the "dgst" command +to compute the fingerprint.

+ +

The actual command to transform the key to DER format depends +on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the +"pkey" command supports all key types. With OpenSSL 0.9.8 and +earlier, the key type is always RSA (nobody uses DSA, and EC +keys are not fully supported by 0.9.8), so the "rsa" command is +used.

+
+
+# OpenSSL 1.0 with all certificates and SHA-1 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl pkey -pubin -outform DER |
+    openssl dgst -sha1 -c
+(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58
+
+
+ +
+
+# OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl rsa -pubin -outform DER |
+    openssl dgst -md5 -c
+(stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50
+
+
+ +

The Postfix SMTP server and client log the peer (leaf) certificate +fingerprint and public key fingerprint when TLS loglevel is 1 or +higher.

+ +

Note: Postfix 2.9.0–2.9.5 computed the public key +fingerprint incorrectly. To use public-key fingerprints, upgrade +to Postfix 2.9.6 or later.

This feature is available in Postfix 2.5 and later.

@@ -11807,11 +11847,47 @@ SHA1 Fingerprint=D4:6A:AB:19:24:79:F8:32:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A -

Public key fingerprints are more difficult to extract, however, -the SHA-1 public key fingerprint is often present as the value of the -"Subject Key Identifier" extension in X.509v3 certificates. The Postfix -SMTP server and client log the peer certificate fingerprint and public -key fingerprint when TLS loglevel is 1 or higher.

+

To extract the public key fingerprint from an X.509 certificate, +you need to extract the public key from the certificate and compute +the appropriate digest of its DER (ASN.1) encoding. With OpenSSL +the "-pubkey" option of the "x509" command extracts the public +key always in "PEM" format. We pipe the result to another OpenSSL +command that converts the key to DER and then to the "dgst" command +to compute the fingerprint.

+ +

The actual command to transform the key to DER format depends +on the version of OpenSSL used. With OpenSSL 1.0.0 and later, the +"pkey" command supports all key types. With OpenSSL 0.9.8 and +earlier, the key type is always RSA (nobody uses DSA, and EC +keys are not fully supported by 0.9.8), so the "rsa" command is +used.

+
+
+# OpenSSL 1.0 with all certificates and SHA-1 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl pkey -pubin -outform DER |
+    openssl dgst -sha1 -c
+(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58
+
+
+ +
+
+# OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints.
+$ openssl x509 -in cert.pem -noout -pubkey |
+    openssl rsa -pubin -outform DER |
+    openssl dgst -md5 -c
+(stdin)= f4:62:60:f6:12:8f:d5:8d:28:4d:13:a7:db:b2:ff:50
+
+
+ +

The Postfix SMTP server and client log the peer (leaf) certificate +fingerprint and public key fingerprint when TLS loglevel is 1 or +higher.

+ +

Note: Postfix 2.9.0–2.9.5 computed the public key +fingerprint incorrectly. To use public-key fingerprints, upgrade +to Postfix 2.9.6 or later.

Example: client-certificate access table, with sha1 fingerprints:

@@ -14099,6 +14175,21 @@ OpenSSL 1.0.0.

This feature is available in Postfix 2.8 and later.

+%PARAM tls_legacy_public_key_fingerprints no + +

A temporary migration aid for sites that use certificate +public-key fingerprints with Postfix 2.9.0..2.9.5, which use +an incorrect algorithm. This parameter has no effect on the certificate +fingerprint support that is available since Postfix 2.2.

+ +

Specify "tls_legacy_public_key_fingerprints = yes" temporarily, +pending a migration from configuration files with incorrect Postfix +2.9.0..2.9.5 certificate public-key finger prints, to the correct +fingerprints used by Postfix 2.9.6 and later. To compute the correct +certificate public-key fingerprints, see TLS_README.

+ +

This feature is available in Postfix 2.9.6 and later.

+ %PARAM tlsproxy_watchdog_timeout 10s

How much time a tlsproxy(8) process may take to process local @@ -14816,8 +14907,9 @@ limited to 13 over the lifetime of a daemon process.

%PARAM smtpd_log_access_permit_actions empty

Enable logging of the named "permit" actions in SMTP server -access lists. This does not affect conditional actions such as -"defer_if_permit".

+access lists (by default, the SMTP server logs "reject" actions but +not "permit" actions). This feature does not affect conditional +actions such as "defer_if_permit".

Specify a list of "permit" action names, "/file/name" or "type:table" patterns, separated by commas and/or whitespace. The diff --git a/postfix/src/global/mail_params.h b/postfix/src/global/mail_params.h index 57135a0f7..9c5fde004 100644 --- a/postfix/src/global/mail_params.h +++ b/postfix/src/global/mail_params.h @@ -3042,6 +3042,10 @@ extern bool var_tls_preempt_clist; #define DEF_TLS_BUG_TWEAKS TLS_BUG_TWEAKS extern char *var_tls_bug_tweaks; +#define VAR_TLS_BC_PKEY_FPRINT "tls_legacy_public_key_fingerprints" +#define DEF_TLS_BC_PKEY_FPRINT 0 +extern bool var_tls_bc_pkey_fprint; + /* * Sendmail-style mail filter support. */ diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h index edaa8b60b..6a7ba6be8 100644 --- a/postfix/src/global/mail_version.h +++ b/postfix/src/global/mail_version.h @@ -20,7 +20,7 @@ * Patches change both the patchlevel and the release date. Snapshots have no * patchlevel; they change the release date only. */ -#define MAIL_RELEASE_DATE "20130201" +#define MAIL_RELEASE_DATE "20130204" #define MAIL_VERSION_NUMBER "2.10" #ifdef SNAPSHOT diff --git a/postfix/src/tls/Makefile.in b/postfix/src/tls/Makefile.in index 48e13f06e..57096e124 100644 --- a/postfix/src/tls/Makefile.in +++ b/postfix/src/tls/Makefile.in @@ -320,6 +320,7 @@ tls_stream.o: ../../include/vstring.h tls_stream.o: tls.h tls_stream.o: tls_stream.c tls_verify.o: ../../include/argv.h +tls_verify.o: ../../include/mail_params.h tls_verify.o: ../../include/msg.h tls_verify.o: ../../include/mymalloc.h tls_verify.o: ../../include/name_code.h diff --git a/postfix/src/tls/tls_misc.c b/postfix/src/tls/tls_misc.c index 027e6c37b..d09bb3225 100644 --- a/postfix/src/tls/tls_misc.c +++ b/postfix/src/tls/tls_misc.c @@ -17,6 +17,7 @@ /* int var_tls_daemon_rand_bytes; /* bool var_tls_append_def_CA; /* bool var_tls_preempt_clist; +/* bool var_tls_bc_pkey_fprint; /* /* TLS_APPL_STATE *tls_alloc_app_context(ssl_ctx, log_mask) /* SSL_CTX *ssl_ctx; @@ -205,6 +206,7 @@ char *var_tls_eecdh_strong; char *var_tls_eecdh_ultra; bool var_tls_append_def_CA; char *var_tls_bug_tweaks; +bool var_tls_bc_pkey_fprint; #ifdef VAR_TLS_PREEMPT_CLIST bool var_tls_preempt_clist; @@ -551,6 +553,7 @@ void tls_param_init(void) }; static const CONFIG_BOOL_TABLE bool_table[] = { VAR_TLS_APPEND_DEF_CA, DEF_TLS_APPEND_DEF_CA, &var_tls_append_def_CA, + VAR_TLS_BC_PKEY_FPRINT, DEF_TLS_BC_PKEY_FPRINT, &var_tls_bc_pkey_fprint, #if OPENSSL_VERSION_NUMBER >= 0x0090700fL /* OpenSSL 0.9.7 and later */ VAR_TLS_PREEMPT_CLIST, DEF_TLS_PREEMPT_CLIST, &var_tls_preempt_clist, #endif diff --git a/postfix/src/tls/tls_verify.c b/postfix/src/tls/tls_verify.c index d305cc692..ea3bfb960 100644 --- a/postfix/src/tls/tls_verify.c +++ b/postfix/src/tls/tls_verify.c @@ -23,6 +23,10 @@ /* X509 *peercert; /* const char *dgst; /* +/* char *tls_pkey_fprint(peercert, dgst) +/* X509 *peercert; +/* const char *dgst; +/* /* int tls_verify_certificate_callback(ok, ctx) /* int ok; /* X509_STORE_CTX *ctx; @@ -50,6 +54,11 @@ /* value is dynamically allocated with mymalloc(), and the caller /* must eventually free it with myfree(). /* +/* tls_pkey_fprint() returns a public-key fingerprint; in all +/* other respects the function behaves as tls_fingerprint(). +/* The var_tls_bc_pkey_fprint variable enables an incorrect +/* algorithm that was used in Postfix versions 2.9.[0-5]. +/* /* tls_verify_callback() is called several times (directly or /* indirectly) from crypto/x509/x509_vfy.c. It is called as /* a final check, and if it returns "0", the handshake is @@ -140,6 +149,10 @@ #include #include +/* Global library. */ + +#include + /* TLS library. */ #define TLS_INTERNAL @@ -490,14 +503,12 @@ char *tls_issuer_CN(X509 *peer, const TLS_SESS_STATE *TLScontext) return (cn ? cn : mystrdup("")); } -typedef int (*x509_dgst_cb) (const X509 *, const EVP_MD *, unsigned char *, unsigned int *); - -/* tls_fprint - extract cert or pkey fingerprint from certificate */ +/* tls_fprint - compute and encode digest of DER-encoded object */ -static char *tls_fprint(X509 *peercert, x509_dgst_cb x509_dgst, - const char *dgst) +static char *tls_fprint(const char *buf, int len, const char *dgst) { - const char *myname = "tls_fingerprint"; + const char *myname = "tls_fprint"; + EVP_MD_CTX *mdctx; const EVP_MD *md_alg; unsigned char md_buf[EVP_MAX_MD_SIZE]; unsigned int md_len; @@ -508,10 +519,12 @@ static char *tls_fprint(X509 *peercert, x509_dgst_cb x509_dgst, if ((md_alg = EVP_get_digestbyname(dgst)) == 0) msg_panic("%s: digest algorithm \"%s\" not found", myname, dgst); - /* Fails when serialization to ASN.1 runs out of memory */ - if (x509_dgst(peercert, md_alg, md_buf, &md_len) == 0) - msg_fatal("%s: error computing certificate %s digest (out of memory?)", - myname, dgst); + mdctx = EVP_MD_CTX_create(); + if (EVP_DigestInit_ex(mdctx, md_alg, NULL) == 0 + || EVP_DigestUpdate(mdctx, buf, len) == 0 + || EVP_DigestFinal_ex(mdctx, md_buf, &md_len) == 0) + msg_fatal("%s: error computing %s message digest", myname, dgst); + EVP_MD_CTX_destroy(mdctx); /* Check for OpenSSL contract violation */ if (md_len > EVP_MAX_MD_SIZE || md_len >= INT_MAX / 3) @@ -531,14 +544,55 @@ static char *tls_fprint(X509 *peercert, x509_dgst_cb x509_dgst, char *tls_fingerprint(X509 *peercert, const char *dgst) { - return (tls_fprint(peercert, X509_digest, dgst)); + int len; + char *buf; + char *buf2; + char *result; + + len = i2d_X509(peercert, NULL); + buf2 = buf = mymalloc(len); + i2d_X509(peercert, (unsigned char **)&buf2); + if (buf2 - buf != len) + msg_panic("i2d_X509 invalid result length"); + + result = tls_fprint(buf, len, dgst); + myfree(buf); + + return (result); } /* tls_pkey_fprint - extract public key fingerprint from certificate */ char *tls_pkey_fprint(X509 *peercert, const char *dgst) { - return (tls_fprint(peercert, X509_pubkey_digest, dgst)); + if (var_tls_bc_pkey_fprint) { + const char *myname = "tls_pkey_fprint"; + ASN1_BIT_STRING *key; + char *result; + + key = X509_get0_pubkey_bitstr(peercert); + if (key == 0) + msg_fatal("%s: error extracting legacy public-key fingerprint: %m", + myname); + + result = tls_fprint((char *) key->data, key->length, dgst); + return (result); + } else { + int len; + char *buf; + char *buf2; + char *result; + + len = i2d_X509_PUBKEY(X509_get_X509_PUBKEY(peercert), NULL); + buf2 = buf = mymalloc(len); + i2d_X509_PUBKEY(X509_get_X509_PUBKEY(peercert), (unsigned char **) &buf2); + if (buf2 - buf != len) + msg_panic("i2d_X509_PUBKEY invalid result length"); + + result = tls_fprint(buf, len, dgst); + myfree(buf); + return (result); + } } #endif