From: Wietse Venema Date: Sun, 17 Jun 2018 05:00:00 +0000 (-0500) Subject: postfix-3.4-20180617 X-Git-Tag: v3.4.0-RC1~35 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9afaf0de4d21b5079bfc174d95489a9159a89e53;p=thirdparty%2Fpostfix.git postfix-3.4-20180617 --- diff --git a/postfix/HISTORY b/postfix/HISTORY index c8412f1dd..1ef6ecf5b 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -23399,6 +23399,38 @@ Apologies for any names omitted. TLS handshake error. Found during code maintenance. File: tlsproxy/tlsproxy.c. + Connection reuse for TLS-encrypted SMTP sessions. This is + work-in-progress, #ifdef USE_TLSPROXY, to avoid contamination + of existing code. + + The idea is to have smtp(8) talk plaintext while tlsproxy(8) + converts between local plaintext and remote ciphertext. + Then, smtp(8) can save plaintext connections to the cache, + and scache(8) holds the handles to the tlsproxy(8) processes. + + This preliminary implementation does not yet support proxying + of DANE attributes from smtp(8) to tlsproxy(8). tlsproxy(8) + does not have permissions to read private key files that + smtp(8) can read. And the name of a connection cache entry + does not yet depend on whether the cached connection uses + TLS, nor does it depend on DANE information. + + Files: global/mail_proto.h, postscreen/postscreen_starttls.c, + posttls-finger/posttls-finger.c, smtp/smtp.c, smtp/smtp.h, + smtp/smtp_params.c, smtp/smtp_proto.c, smtp/smtp_session.c, + smtpd/smtpd.c, tls/tls.h, tls/tls_client.c, tls/tls_proxy.h, + tls/tls_proxy_client_init_print.c, + tls/tls_proxy_client_init_scan.c, + tls/tls_proxy_client_start_print.c, + tls/tls_proxy_client_start_scan.c, tls/tls_proxy_clnt.c, + tls/tls_proxy_context_print.c, tls/tls_proxy_context_scan.c, + tls/tls_proxy_server_init_print.c, + tls/tls_proxy_server_init_scan.c, + tls/tls_proxy_server_start_print.c, + tls/tls_proxy_server_start_scan.c, tlsproxy/tlsproxy.c, + tlsproxy/tlsproxy.h, tlsproxy/tlsproxy_state.c, util/argv_attr.h, + util/argv_attr_print.c, util/argv_attr_scan.c. + 20180425 Cleanup: dnsblog proccesses now retire voluntarily after @@ -23445,3 +23477,61 @@ Apologies for any names omitted. Documentation: bash syntax to eliminate or view default settings in "postconf -n" output. File: postconf/postconf.c. Contributed by various postfix-users list members. + +20180603 + + TLS reuse: serializer/deserializer support for TLS_DANE and + related data structures. Files: tls/tls_proxy_client_print.c, + tls/tls_proxy_client_scan.c, tls/tls_proxy.h, util/argv_attr.h, + util/argv_attr_print.c, util/argv_attr_scan.c. + + TLS reuse: posttls-finger -X test flag for quick tests. + File: posttls-finger/posttls-finger.c. + + TLS reuse: smtp_use_tlsproxy boolean parameter. This is a + preliminary implementation that should support override via + smtp_tls_policy_maps. Files: smtp.c, smtp_connect.c, + smtp_params.c, smtp_proto.c, smtp_session.c. + + TLS reuse: the SMTP client now includes the requested TLS + security level in the scache(8) key. + + TLS reuse: address-based reuse is allowed only for TLS + levels that require no certificate checks. Perhaps it still + makes sense to save such sessions for reuse by less sensitive + deliveries. Files: smtp/smtp.h smtp/smtp_reuse.c. + +20180604 + + TLS reuse: smtp_tls_connection_reuse boolean parameter, and + corresponding override with "connection_reuse" boolean + attribute in smtp_policy_maps. Files: global/mail_params.h, + smtp.c, smtp.h, smtp_params.c, smtp_proto.c, smtp_session.c, + smtp_tls_policy.c. proto/postconf.proto. mantools/postlink. + +20180605 + + TLS reuse: updated TLS_README and CONNECTION_CACHE_README, + added comments in tlsproxy.c to explain why it works. + +20180617 + + Bugfix (introduced: Postfix 2.11): minor memory leak when + minting issuer certs. This affects a tiny minority of use + cases. Fix by Viktor Dukhovni, based on a fix by Juan + Altmayer Pizzorno for Viktor's ssl_dane library. + + Cleanup: support for longer timeouts after the TLS handshake, + so that the tlsproxy server won't time out too soon, while + the SMTP client waits for the end-of-data response. This + tlxproxy timeout is a redundant safety feature for the case + that the SMTP client does not enforce the SMTP-level time + limit. Files: tls/tls_proxy.h, tls/tls_proxy_clnt.c, + tlsproxy/tlsproxy.c, posttls-finger/posttls-finger.c, + postcreen/postscreen_starttls.c, smtp/smtp_proto.c. + + Cleanup: earlier purging of unexpected plaintext. Files: + posttls-finger/posttls-finger.c, smtp/smtp_proto.c. + + Release: first production snapshot with multiple outbound + deliveries per TLS-encrypted connection. diff --git a/postfix/README_FILES/CONNECTION_CACHE_README b/postfix/README_FILES/CONNECTION_CACHE_README index 5067f7aea..408d3b54d 100644 --- a/postfix/README_FILES/CONNECTION_CACHE_README +++ b/postfix/README_FILES/CONNECTION_CACHE_README @@ -7,6 +7,9 @@ IInnttrroodduuccttiioonn This document describes the Postfix connection cache implementation, which is available with Postfix version 2.2 and later. +See Client-side TLS connection reuse for how this connection cache is used to +implement multiple deliveries per TLS-encrypted connection. + Topics covered in this document: * What SMTP connection caching can do for you @@ -64,14 +67,14 @@ to access this cache. /-- smtp(8) --> Internet - qmgr(8) | - | - \-- | smtp(8) --> Internet - | - ^ - | + qmgr(8) + | + \-- | smtp(8) --> Internet + | + ^ + | - scache(8) + scache(8) When SMTP connection caching is enabled (see next section), the smtp(8) client does not disconnect after a mail transaction, but gives the connection to the diff --git a/postfix/README_FILES/TLS_README b/postfix/README_FILES/TLS_README index 15b5e52c3..37622d383 100644 --- a/postfix/README_FILES/TLS_README +++ b/postfix/README_FILES/TLS_README @@ -707,6 +707,7 @@ Topics covered in this section: * Configuring TLS in the SMTP/LMTP client * Client-side TLS activity logging * Client-side certificate and private key configuration + * Client-side TLS connection reuse * Client-side TLS session cache * Client TLS limitations * Per-destination TLS policy @@ -1432,6 +1433,43 @@ Example: smtp_tls_CAfile = /etc/postfix/CAcert.pem smtp_tls_CApath = /etc/postfix/certs +CClliieenntt--ssiiddee TTLLSS ccoonnnneeccttiioonn rreeuussee + +Historically, the Postfix SMTP client has supported multiple deliveries per +connection only for plaintext connections. Postfix 3.4 introduces the ability +to make multiple deliveries per TLS-encrypted connection. This is primarily to +improve mail delivery performance for destinations that throttle clients when +they don't combine deliveries. + +To enable multiple deliveries per TLS connection, specify: + + /etc/postfix/main.cf: + smtp_tls_connection_reuse = yes + +Alternatively, specify the attribute "connection_reuse=yes" in an +smtp_tls_policy_maps entry. + +The implementation of TLS connection reuse relies on the same scache(8) service +as used for delivering plaintext SMTP mail, the same tlsproxy(8) daemon as used +by the postscreen(8) service, and relies on the same hints from the qmgr(8) +daemon. See "Postfix Connection Cache" for a description of the underlying +connection reuse infrastructure. + +Initial SMTP handshake: + + smtp(8) -> remote SMTP server + +Reused SMTP/TLS connection, or new SMTP/TLS connection: + + smtp(8) -> tlsproxy(8) -> remote SMTP server + +Cached SMTP/TLS connection: + + scache(8) -> tlsproxy(8) -> remote SMTP server + +As of Postfix 3.4, TLS connection reuse is disabled by default. This may change +once the impact on over-all performance is undestood. + CClliieenntt--ssiiddee TTLLSS sseessssiioonn ccaacchhee The remote SMTP server and the Postfix SMTP client negotiate a session, which diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index 653024e74..591c9ab4a 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -24,3 +24,46 @@ historical IBM Public License 1.0, it is now also distributed with the more recent Eclipse Public License 2.0. Recipients can choose to take the software under the license of their choice. Those who are more comfortable with the IPL can continue with that license. + +Major changes with snapshot 20180617 +==================================== + +Preliminary Postfix SMTP client support for multiple deliveries per +TLS-encrypted connection. This is primarily to improve mail delivery +performance for destinations that throttle clients when they don't +combine deliveries. + +This feature is enabled with "smtp_tls_connection_reuse=yes" in +main.cf, or with "tls_connection_reuse=yes" in smtp_tls_policy_maps. +It supports all Postfix TLS security levels including dane and +dane-only. + +With connection reuse enabled as described above, the Postfix SMTP +client uses the tlsproxy(8) server to encrypt a connection (even under +low-traffic conditions). The tlsproxy(8) service was introduced in +Postfix 2.8, to support STARTTLS in postscreen(8). + +Under high-traffic conditions, the Postfix SMTP client will use the +scache(8) connection cache to store and retrieve open connections. +This part already existed for plaintext SMTP, and it works in the +same way for TLS-encryped connections. + +The following illustrates how TLS connections are reused: + + Initial plaintext SMTP handshake: + smtp(8) -> remote SMTP server + + Reused SMTP/TLS connection, or new SMTP/TLS connection: + smtp(8) -> tlsproxy(8) -> remote SMTP server + + Cached SMTP/TLS connection: + scache(8) -> tlsproxy(8) -> remote SMTP server + +There are a few refinements planned: + +- Log the TLS properties every time a connection is reused. + Currently, the properties are logged when a TLS session is created. + +- Retire a tlsproxy(8) process after max_idle*max_use seconds, even + if it is not idle. This limits the impact of memory leaks in + libraries or in Postfix itself. diff --git a/postfix/WISHLIST b/postfix/WISHLIST index 42106f2c3..07ca8baf9 100644 --- a/postfix/WISHLIST +++ b/postfix/WISHLIST @@ -1,5 +1,21 @@ Wish list: + Add 'retire after max_use * max_idle' support to the + event-server, so that tlsproxy processes will terminate + even on a busy server. This can build on the retirement + support for the dnsblog server. + + With smtpd_reject_footer=$foo in master.cf, and foo defined + in main.cf, postconf complains about an unused setting in + main.cf. Note that "postconf -Px" will expand $name in + the parameter value, which is probably why the warning + exists. + + Optionally save application attributes in scache(8) connection + store requests, and optionally request such attributes upon + connection retrieval. This would allow the SMTP client to + log the TLS properties of a reused session. + Things to do before the stable release: Spell-check, double-word check, HTML validator check, diff --git a/postfix/html/CONNECTION_CACHE_README.html b/postfix/html/CONNECTION_CACHE_README.html index b0201dc93..e808180a7 100644 --- a/postfix/html/CONNECTION_CACHE_README.html +++ b/postfix/html/CONNECTION_CACHE_README.html @@ -22,6 +22,10 @@

This document describes the Postfix connection cache implementation, which is available with Postfix version 2.2 and later.

+

See Client-side TLS +connection reuse for how this connection cache is used to +implement multiple deliveries per TLS-encrypted connection.

+

Topics covered in this document: