From 47ae1804cce8f6f96975788bdba617199868c9da Mon Sep 17 00:00:00 2001 From: Wietse Z Venema Date: Thu, 6 Feb 2025 00:00:00 -0500 Subject: [PATCH] postfix-3.10-20250206 --- postfix/HISTORY | 2 +- postfix/README_FILES/TLSRPT_README | 30 ++++++++++++------------- postfix/html/TLSRPT_README.html | 35 +++++++++++++++--------------- postfix/html/postconf.5.html | 14 ++++++++++-- postfix/man/man5/postconf.5 | 13 ++++++++++- postfix/mantools/make-relnotes | 15 ++++++------- postfix/proto/TLSRPT_README.html | 35 +++++++++++++++--------------- postfix/proto/postconf.proto | 14 ++++++++++-- postfix/proto/stop | 5 +++++ postfix/src/global/mail_version.h | 2 +- 10 files changed, 99 insertions(+), 66 deletions(-) diff --git a/postfix/HISTORY b/postfix/HISTORY index e30ce59cc..c4ad2197e 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -28038,7 +28038,7 @@ Apologies for any names omitted. Documentation: replace the obsolete pickup service type fifo with unix, and fix typos. Dilyan Palauzov. Files: - HISTORY< proto/BUILTIN_FILTER_README.html, + HISTORY, proto/BUILTIN_FILTER_README.html, proto/STANDARD_CONFIGURATION_README.html 20240418 diff --git a/postfix/README_FILES/TLSRPT_README b/postfix/README_FILES/TLSRPT_README index fe26e3b04..a26253612 100644 --- a/postfix/README_FILES/TLSRPT_README +++ b/postfix/README_FILES/TLSRPT_README @@ -20,15 +20,12 @@ domain can publish a policy in DNS, and request daily summary reports for successful and failed SMTP over TLS connections to that domain's MX hosts. Support for TLSRPT was added in Postfix 3.10. -A policy example looks like this: +A policy for domain example.com could look like this: _smtp._tls.example.com. IN TXT "v=TLSRPTv1; rua=mailto:smtp-tls- report@example.com" -Translation: email sending systems are requested to generate daily summaries of -successful and failed SMTP over TLS connections to domain example.com, and to -report those summaries via email to the specified address. Instead of mailto:, -a policy may specify an https: destination. +Instead of mailto:, a policy may specify an https: destination. The diagram below shows how Postfix TLS handshake success and failure events are collected and processed into daily summary reports. @@ -52,8 +49,8 @@ TLSRPT information, are implemented and maintained by sys4 at https:// github.com/sys4/libtlsrpt and https://github.com/sys4/tlsrpt-reporter, respectively. -The Postfix implementation supports domains with DANE (Postfix built-in) and -MTA-STS (through an smtp_tls_policy_maps plug-in). +The Postfix implementation supports TLSRPT or domains with DANE (Postfix built- +in) and MTA-STS (through an smtp_tls_policy_maps plug-in). The Postfix smtp(8) client process implements the SMTP client engine. With "smtp_tls_connection_reuse = no", the smtp(8) client process also implements @@ -230,8 +227,8 @@ MMTTAA--SSTTSS SSuuppppoorrtt vviiaa ssmmttpp__ttllss_ Postfix supports MTA-STS though an smtp_tls_policy_maps policy plugin, which replies with a TLS security level and name=value attributes with certificate -matching requirements. Postfix 3.10 and later accept additional name=value -attributes that are needed for TLSRPT. +matching requirements. Postfix 3.10 and later extend the policy plugin response +with additional name=value attributes that are needed for TLSRPT. Examples of smtp_tls_policy_maps plugins with MTA-STS support are: @@ -244,7 +241,8 @@ Both plugins can generate the additional name=value attributes that Postfix needs for TLSRPT support (as of February 2025). This is enabled by setting a tlsrpt boolean in a plugin configuration file. This setting is safe with Postfix 3.10 and later, even if Postfix TLSRPT support is disabled (at build -time or at run time). +time or at run time). Postfix versions 3.9 and earlier will report a policy +error with "invalid attribute name". The examples in the text below apply to this MTA-STS policy example given in RFC 8461 Section 3.2: @@ -264,6 +262,8 @@ contain line breaks. Specify sts or no-policy-found. + Example: policy_type=sts + * policy_domain=name The domain that the MTA-STS policy applies to. @@ -297,7 +297,7 @@ contain line breaks. Example: policy_failure=sts-webpki-invalid - * policy_ttl=time + * policy_ttl=time (deprecated) This attribute is deprecated. The time value is not used, and support for this attribute will eventually be removed from the code. @@ -305,10 +305,10 @@ contain line breaks. Notes: * Postfix 3.10 and later will accept these additional attributes in an MTA- - STS response even if TLSRPT support is disabled (at build time or at run - time). With TLSRPT support turned off, Postfix may still use the - policy_failure attribute, and will ignore the attributes that are used only - for TLSRPT. + STS response even if Postfix TLSRPT support is disabled (at build time or + at run time). With Postfix TLSRPT support turned off, Postfix may still use + the policy_failure attribute, and will ignore the attributes that are used + only for TLSRPT. * It is an error to specify these attributes for a non-STS policy. diff --git a/postfix/html/TLSRPT_README.html b/postfix/html/TLSRPT_README.html index cef622abd..8352008ac 100644 --- a/postfix/html/TLSRPT_README.html +++ b/postfix/html/TLSRPT_README.html @@ -41,7 +41,7 @@ summary reports for successful and failed SMTP over TLS connections to that domain's MX hosts. Support for TLSRPT was added in Postfix 3.10.

-

A policy example looks like this:

+

A policy for domain example.com could look like this: 

@@ -49,11 +49,8 @@ _smtp._tls.example.com. IN TXT "v=TLSRPTv1; rua=mailto:smtp-tls-report@example.c
-

Translation: email sending systems are requested to generate daily -summaries of successful and failed SMTP over TLS connections to domain -example.com, and to report those summaries via email to the -specified address. Instead of mailto:, a policy may specify an -https: destination.

+

Instead of mailto:, a policy may specify an https: +destination.

The diagram below shows how Postfix TLS handshake success and failure events are collected and processed into daily summary @@ -102,9 +99,9 @@ fetch, and report TLSRPT information, are implemented and maintained by sys4 at https://github.com/sys4/libtlsrpt and https://github.com/sys4/tlsrpt-reporter, respectively.

-

The Postfix implementation supports domains with DANE (Postfix -built-in) and MTA-STS (through an smtp_tls_policy_maps plug-in). -

+

The Postfix implementation supports TLSRPT or domains with DANE +(Postfix built-in) and MTA-STS (through an +smtp_tls_policy_maps plug-in).

The Postfix smtp(8) client process implements the SMTP client engine. With "smtp_tls_connection_reuse = no", the smtp(8) client @@ -335,8 +332,8 @@ generator's sender address):

Postfix supports MTA-STS though an smtp_tls_policy_maps policy plugin, which replies with a TLS security level and name=value attributes with certificate matching requirements. Postfix 3.10 and -later accept additional name=value attributes that are needed for -TLSRPT.

+later extend the policy plugin response with additional name=value +attributes that are needed for TLSRPT.

Examples of smtp_tls_policy_maps plugins with MTA-STS support are:

@@ -357,7 +354,8 @@ that Postfix needs for TLSRPT support (as of February 2025). This is enabled by setting a tlsrpt boolean in a plugin configuration file. This setting is safe with Postfix 3.10 and later, even if Postfix TLSRPT support is disabled (at build time -or at run time).

+or at run time). Postfix versions 3.9 and earlier will report a +policy error with "invalid attribute name".

The examples in the text below apply to this MTA-STS policy example given in

policy_type=type

-

Specify sts or no-policy-found.

+

Specify sts or no-policy-found.

+ +

Example: policy_type=sts

  • policy_domain=name

    The domain that the MTA-STS policy applies to.

    -

    Example: policy_domain=example.com

    • @@ -425,7 +424,7 @@ informative validation-failure.

    Example: policy_failure=sts-webpki-invalid

    -

  • policy_ttl=time

    +

  • policy_ttl=time (deprecated)

    This attribute is deprecated. The time value is not used, and support for this attribute will eventually be removed from the @@ -438,9 +437,9 @@ code.