From: Wietse Venema Date: Tue, 5 Jun 2018 05:00:00 +0000 (-0500) Subject: postfix-3.4-20180605-nonprod X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fheads%2F20180603-nonprod;p=thirdparty%2Fpostfix.git postfix-3.4-20180605-nonprod --- diff --git a/postfix/HISTORY b/postfix/HISTORY index b856888d3..1c6683657 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -23500,3 +23500,16 @@ Apologies for any names omitted. levels that require no certificate checks. Perhaps it still makes sense to save such sessions for reuse by less sensitive deliveries. Files: smtp/smtp.h smtp/smtp_reuse.c. + +20180604 + + TLS reuse: smtp_tls_connection_reuse boolean parameter, and + corresponding override with "connection_reuse" boolean + attribute in smtp_policy_maps. Files: global/mail_params.h, + smtp.c, smtp.h, smtp_params.c, smtp_proto.c, smtp_session.c, + smtp_tls_policy.c. proto/postconf.proto. mantools/postlink. + +20180605 + + TLS reuse: updated TLS_README and CONNECTION_CACHE_README, + added comments in tlsproxy.c to explain why it works. diff --git a/postfix/README_FILES/CONNECTION_CACHE_README b/postfix/README_FILES/CONNECTION_CACHE_README index 5067f7aea..408d3b54d 100644 --- a/postfix/README_FILES/CONNECTION_CACHE_README +++ b/postfix/README_FILES/CONNECTION_CACHE_README @@ -7,6 +7,9 @@ IInnttrroodduuccttiioonn This document describes the Postfix connection cache implementation, which is available with Postfix version 2.2 and later. +See Client-side TLS connection reuse for how this connection cache is used to +implement multiple deliveries per TLS-encrypted connection. + Topics covered in this document: * What SMTP connection caching can do for you @@ -64,14 +67,14 @@ to access this cache. /-- smtp(8) --> Internet - qmgr(8) | - | - \-- | smtp(8) --> Internet - | - ^ - | + qmgr(8) + | + \-- | smtp(8) --> Internet + | + ^ + | - scache(8) + scache(8) When SMTP connection caching is enabled (see next section), the smtp(8) client does not disconnect after a mail transaction, but gives the connection to the diff --git a/postfix/README_FILES/TLS_README b/postfix/README_FILES/TLS_README index 15b5e52c3..37622d383 100644 --- a/postfix/README_FILES/TLS_README +++ b/postfix/README_FILES/TLS_README @@ -707,6 +707,7 @@ Topics covered in this section: * Configuring TLS in the SMTP/LMTP client * Client-side TLS activity logging * Client-side certificate and private key configuration + * Client-side TLS connection reuse * Client-side TLS session cache * Client TLS limitations * Per-destination TLS policy @@ -1432,6 +1433,43 @@ Example: smtp_tls_CAfile = /etc/postfix/CAcert.pem smtp_tls_CApath = /etc/postfix/certs +CClliieenntt--ssiiddee TTLLSS ccoonnnneeccttiioonn rreeuussee + +Historically, the Postfix SMTP client has supported multiple deliveries per +connection only for plaintext connections. Postfix 3.4 introduces the ability +to make multiple deliveries per TLS-encrypted connection. This is primarily to +improve mail delivery performance for destinations that throttle clients when +they don't combine deliveries. + +To enable multiple deliveries per TLS connection, specify: + + /etc/postfix/main.cf: + smtp_tls_connection_reuse = yes + +Alternatively, specify the attribute "connection_reuse=yes" in an +smtp_tls_policy_maps entry. + +The implementation of TLS connection reuse relies on the same scache(8) service +as used for delivering plaintext SMTP mail, the same tlsproxy(8) daemon as used +by the postscreen(8) service, and relies on the same hints from the qmgr(8) +daemon. See "Postfix Connection Cache" for a description of the underlying +connection reuse infrastructure. + +Initial SMTP handshake: + + smtp(8) -> remote SMTP server + +Reused SMTP/TLS connection, or new SMTP/TLS connection: + + smtp(8) -> tlsproxy(8) -> remote SMTP server + +Cached SMTP/TLS connection: + + scache(8) -> tlsproxy(8) -> remote SMTP server + +As of Postfix 3.4, TLS connection reuse is disabled by default. This may change +once the impact on over-all performance is undestood. + CClliieenntt--ssiiddee TTLLSS sseessssiioonn ccaacchhee The remote SMTP server and the Postfix SMTP client negotiate a session, which diff --git a/postfix/html/CONNECTION_CACHE_README.html b/postfix/html/CONNECTION_CACHE_README.html index b0201dc93..e808180a7 100644 --- a/postfix/html/CONNECTION_CACHE_README.html +++ b/postfix/html/CONNECTION_CACHE_README.html @@ -22,6 +22,10 @@

This document describes the Postfix connection cache implementation, which is available with Postfix version 2.2 and later.

+

See Client-side TLS +connection reuse for how this connection cache is used to +implement multiple deliveries per TLS-encrypted connection.

+

Topics covered in this document: