From bb1909906d75708379bb61c565bcf38f42a7dfe1 Mon Sep 17 00:00:00 2001
From: Wietse Venema
The TLS policy for MX hosts with "secure" TLSA records when the nexthop destination security level is dane, but the MX @@ -12544,7 +12544,7 @@ handshake fails, mail may be sent in the clear.
The default setting for Postfix ≥ 3.6 is "dane" with +"smtp_tls_security_level = dane", otherwise "may". With earlier +Postfix versions the defauult setting was always "dane".
+Though with "insecure" MX records an active attacker can compromise SMTP transport security by returning forged MX records, such attacks are "tamper-evident" since any forged MX hostnames diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5 index 93525b472..a54362d19 100644 --- a/postfix/man/man5/postconf.5 +++ b/postfix/man/man5/postconf.5 @@ -8058,7 +8058,7 @@ See "Client\-side TLS connection reuse" for background details. .PP This feature is available in Postfix 3.4 and later. -.SH smtp_tls_dane_insecure_mx_policy (default: dane) +.SH smtp_tls_dane_insecure_mx_policy (default: see "postconf \-d" output) The TLS policy for MX hosts with "secure" TLSA records when the nexthop destination security level is \fBdane\fR, but the MX record was found via an "insecure" MX lookup. The choices are: @@ -8071,7 +8071,7 @@ handshake fails, mail may be sent in the clear. The TLSA records will signal a requirement to use TLS. While TLS encryption will be required, authentication will not be performed. .br -.IP "\fBdane\fR (default)" +.IP "\fBdane\fR" The TLSA records will be used just as with "secure" MX records. TLS encryption will be required, and, if at least one of the TLSA records is "usable", authentication will be required. When @@ -8079,6 +8079,10 @@ authentication succeeds, it will be logged only as "Trusted", not "Verified", because the MX host name could have been forged. .br .br +The default setting for Postfix >= 3.6 is "dane" with +"smtp_tls_security_level = dane", otherwise "may". With earlier +Postfix versions the defauult setting was always "dane". +.PP Though with "insecure" MX records an active attacker can compromise SMTP transport security by returning forged MX records, such attacks are "tamper\-evident" since any forged MX hostnames diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto index c3a93430b..d9cf51cdc 100644 --- a/postfix/proto/postconf.proto +++ b/postfix/proto/postconf.proto @@ -16937,7 +16937,7 @@ clients).
This feature is available in Postfix 3.1 and later. -%PARAM smtp_tls_dane_insecure_mx_policy dane +%PARAM smtp_tls_dane_insecure_mx_policy see "postconf -d" outputThe TLS policy for MX hosts with "secure" TLSA records when the nexthop destination security level is dane, but the MX @@ -16953,7 +16953,7 @@ handshake fails, mail may be sent in the clear.
The default setting for Postfix ≥ 3.6 is "dane" with +"smtp_tls_security_level = dane", otherwise "may". With earlier +Postfix versions the defauult setting was always "dane".
+Though with "insecure" MX records an active attacker can compromise SMTP transport security by returning forged MX records, such attacks are "tamper-evident" since any forged MX hostnames diff --git a/postfix/src/bounce/bounce_template.c b/postfix/src/bounce/bounce_template.c index e7dc4968b..629f83bfe 100644 --- a/postfix/src/bounce/bounce_template.c +++ b/postfix/src/bounce/bounce_template.c @@ -97,6 +97,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/bounce/bounce_template.h b/postfix/src/bounce/bounce_template.h index 10359d429..5b771e466 100644 --- a/postfix/src/bounce/bounce_template.h +++ b/postfix/src/bounce/bounce_template.h @@ -88,6 +88,11 @@ void bounce_templates_dump(VSTREAM *, BOUNCE_TEMPLATES *); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/postfix/src/cleanup/cleanup_out.c b/postfix/src/cleanup/cleanup_out.c index 3ccebec90..5f8ed0a8c 100644 --- a/postfix/src/cleanup/cleanup_out.c +++ b/postfix/src/cleanup/cleanup_out.c @@ -64,6 +64,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/global/been_here.c b/postfix/src/global/been_here.c index 8147829c4..d0c682044 100644 --- a/postfix/src/global/been_here.c +++ b/postfix/src/global/been_here.c @@ -94,6 +94,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/global/been_here.h b/postfix/src/global/been_here.h index 460191389..b5ac2d6f6 100644 --- a/postfix/src/global/been_here.h +++ b/postfix/src/global/been_here.h @@ -47,6 +47,11 @@ extern int PRINTFLIKE(2, 3) been_here_drop(BH_TABLE *, const char *,...); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/postfix/src/global/cleanup_strerror.c b/postfix/src/global/cleanup_strerror.c index 7e3dfe5d9..74a9406da 100644 --- a/postfix/src/global/cleanup_strerror.c +++ b/postfix/src/global/cleanup_strerror.c @@ -38,6 +38,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/global/cleanup_user.h b/postfix/src/global/cleanup_user.h index 3ad4c1b1c..d02e9cbfe 100644 --- a/postfix/src/global/cleanup_user.h +++ b/postfix/src/global/cleanup_user.h @@ -101,6 +101,11 @@ extern const char *cleanup_strflags(unsigned); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/postfix/src/global/delivered_hdr.c b/postfix/src/global/delivered_hdr.c index d86c9e7c2..f1fc05d56 100644 --- a/postfix/src/global/delivered_hdr.c +++ b/postfix/src/global/delivered_hdr.c @@ -67,6 +67,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/global/dsb_scan.c b/postfix/src/global/dsb_scan.c index 4d668f1c2..cf434d119 100644 --- a/postfix/src/global/dsb_scan.c +++ b/postfix/src/global/dsb_scan.c @@ -28,6 +28,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/global/dsb_scan.h b/postfix/src/global/dsb_scan.h index 99485bd8c..69340be34 100644 --- a/postfix/src/global/dsb_scan.h +++ b/postfix/src/global/dsb_scan.h @@ -36,6 +36,11 @@ extern int dsb_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/postfix/src/global/dsn_print.c b/postfix/src/global/dsn_print.c index 26dcb2134..b31ac63d8 100644 --- a/postfix/src/global/dsn_print.c +++ b/postfix/src/global/dsn_print.c @@ -28,6 +28,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/global/dsn_print.h b/postfix/src/global/dsn_print.h index 3e831debd..45808b7c6 100644 --- a/postfix/src/global/dsn_print.h +++ b/postfix/src/global/dsn_print.h @@ -36,6 +36,11 @@ extern int dsn_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, void *); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/postfix/src/global/mail_params.h b/postfix/src/global/mail_params.h index 12499f53b..3ce52a7c0 100644 --- a/postfix/src/global/mail_params.h +++ b/postfix/src/global/mail_params.h @@ -1635,7 +1635,7 @@ extern bool var_smtp_tls_force_tlsa; /* SMTP only */ #define VAR_SMTP_TLS_INSECURE_MX_POLICY "smtp_tls_dane_insecure_mx_policy" -#define DEF_SMTP_TLS_INSECURE_MX_POLICY "dane" +#define DEF_SMTP_TLS_INSECURE_MX_POLICY "${{$smtp_tls_security_level} == {dane} ? {dane} : {may}}" extern char *var_smtp_tls_insecure_mx_policy; /* diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h index acce9f9b3..d5229e897 100644 --- a/postfix/src/global/mail_version.h +++ b/postfix/src/global/mail_version.h @@ -20,7 +20,7 @@ * Patches change both the patchlevel and the release date. Snapshots have no * patchlevel; they change the release date only. */ -#define MAIL_RELEASE_DATE "20201101" +#define MAIL_RELEASE_DATE "20201104" #define MAIL_VERSION_NUMBER "3.6" #ifdef SNAPSHOT diff --git a/postfix/src/global/msg_stats.h b/postfix/src/global/msg_stats.h index 335faf4f1..312accc0b 100644 --- a/postfix/src/global/msg_stats.h +++ b/postfix/src/global/msg_stats.h @@ -94,6 +94,11 @@ extern int msg_stats_print(ATTR_PRINT_COMMON_FN, VSTREAM *, int, void *); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/postfix/src/global/msg_stats_print.c b/postfix/src/global/msg_stats_print.c index f899aef6d..69c96b559 100644 --- a/postfix/src/global/msg_stats_print.c +++ b/postfix/src/global/msg_stats_print.c @@ -29,6 +29,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/global/msg_stats_scan.c b/postfix/src/global/msg_stats_scan.c index c4b4f8942..504a6b062 100644 --- a/postfix/src/global/msg_stats_scan.c +++ b/postfix/src/global/msg_stats_scan.c @@ -28,6 +28,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/global/rcpt_buf.c b/postfix/src/global/rcpt_buf.c index ba9164ee0..8a3ae0f12 100644 --- a/postfix/src/global/rcpt_buf.c +++ b/postfix/src/global/rcpt_buf.c @@ -56,6 +56,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/global/rcpt_buf.h b/postfix/src/global/rcpt_buf.h index c474af3b5..770f011d9 100644 --- a/postfix/src/global/rcpt_buf.h +++ b/postfix/src/global/rcpt_buf.h @@ -57,6 +57,11 @@ extern int rcpb_scan(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/postfix/src/global/rcpt_print.c b/postfix/src/global/rcpt_print.c index 6baabf16c..b81f6a969 100644 --- a/postfix/src/global/rcpt_print.c +++ b/postfix/src/global/rcpt_print.c @@ -30,6 +30,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/global/rcpt_print.h b/postfix/src/global/rcpt_print.h index 9ddb3b24e..d501d2d0a 100644 --- a/postfix/src/global/rcpt_print.h +++ b/postfix/src/global/rcpt_print.h @@ -36,6 +36,11 @@ extern int rcpt_print(ATTR_SCAN_COMMON_FN, VSTREAM *, int, void *); /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/postfix/src/master/master_vars.c b/postfix/src/master/master_vars.c index cd88dcd7e..a2d54412b 100644 --- a/postfix/src/master/master_vars.c +++ b/postfix/src/master/master_vars.c @@ -20,6 +20,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/milter/milter_macros.c b/postfix/src/milter/milter_macros.c index a1ddf968c..8dd60e36a 100644 --- a/postfix/src/milter/milter_macros.c +++ b/postfix/src/milter/milter_macros.c @@ -98,6 +98,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/qmqpd/qmqpd_peer.c b/postfix/src/qmqpd/qmqpd_peer.c index 07d4792b4..290b7f26f 100644 --- a/postfix/src/qmqpd/qmqpd_peer.c +++ b/postfix/src/qmqpd/qmqpd_peer.c @@ -36,6 +36,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/smtp/smtp_proto.c b/postfix/src/smtp/smtp_proto.c index 7fd634863..2bb3d3ca6 100644 --- a/postfix/src/smtp/smtp_proto.c +++ b/postfix/src/smtp/smtp_proto.c @@ -1389,17 +1389,17 @@ static void smtp_mime_fail(SMTP_STATE *state, int mime_errs) /* smtp_out_raw_or_mime - output buffer, raw output or MIME-aware */ -static int smtp_out_raw_or_mime(SMTP_STATE *state, VSTRING *buf) +static int smtp_out_raw_or_mime(SMTP_STATE *state, int rec_type, VSTRING *buf) { SMTP_SESSION *session = state->session; int mime_errs; if (session->mime_state == 0) { - smtp_text_out((void *) state, REC_TYPE_NORM, vstring_str(buf), + smtp_text_out((void *) state, rec_type, vstring_str(buf), VSTRING_LEN(buf), (off_t) 0); } else { mime_errs = - mime_state_update(session->mime_state, REC_TYPE_NORM, + mime_state_update(session->mime_state, rec_type, vstring_str(buf), VSTRING_LEN(buf)); if (mime_errs) { smtp_mime_fail(state, mime_errs); @@ -1423,7 +1423,7 @@ static int smtp_out_add_header(SMTP_STATE *state, const char *label, vstring_str(session->scratch2), QUOTE_FLAG_DEFAULT | QUOTE_FLAG_APPEND); vstring_strcat(session->scratch, gt); - return (smtp_out_raw_or_mime(state, session->scratch)); + return (smtp_out_raw_or_mime(state, REC_TYPE_NORM, session->scratch)); } /* smtp_out_add_headers - output additional headers, uses session->scratch* */ @@ -2307,7 +2307,8 @@ static int smtp_loop(SMTP_STATE *state, NOCLOBBER int send_state, while ((rec_type = rec_get(state->src, session->scratch, 0)) > 0) { if (rec_type != REC_TYPE_NORM && rec_type != REC_TYPE_CONT) break; - if (smtp_out_raw_or_mime(state, session->scratch) < 0) + if (smtp_out_raw_or_mime(state, rec_type, + session->scratch) < 0) RETURN(0); prev_type = rec_type; } diff --git a/postfix/src/util/inet_addr_host.c b/postfix/src/util/inet_addr_host.c index 317ae8595..d2c9d84d9 100644 --- a/postfix/src/util/inet_addr_host.c +++ b/postfix/src/util/inet_addr_host.c @@ -32,6 +32,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/util/inet_connect.c b/postfix/src/util/inet_connect.c index eaa272a43..4c8aa3cfe 100644 --- a/postfix/src/util/inet_connect.c +++ b/postfix/src/util/inet_connect.c @@ -45,6 +45,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System interfaces. */ diff --git a/postfix/src/util/inet_listen.c b/postfix/src/util/inet_listen.c index a87497274..31800cdc3 100644 --- a/postfix/src/util/inet_listen.c +++ b/postfix/src/util/inet_listen.c @@ -49,6 +49,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System libraries. */ diff --git a/postfix/src/util/inet_proto.c b/postfix/src/util/inet_proto.c index d4ad47ffa..fedf7610d 100644 --- a/postfix/src/util/inet_proto.c +++ b/postfix/src/util/inet_proto.c @@ -78,6 +78,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ diff --git a/postfix/src/util/inet_proto.h b/postfix/src/util/inet_proto.h index 68ecce510..9175eaedb 100644 --- a/postfix/src/util/inet_proto.h +++ b/postfix/src/util/inet_proto.h @@ -46,6 +46,11 @@ extern INET_PROTO_INFO *inet_proto_table; /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ #endif diff --git a/postfix/src/util/mystrtok.c b/postfix/src/util/mystrtok.c index 963588737..85b15f3b3 100644 --- a/postfix/src/util/mystrtok.c +++ b/postfix/src/util/mystrtok.c @@ -47,6 +47,11 @@ /* IBM T.J. Watson Research /* P.O. Box 704 /* Yorktown Heights, NY 10598, USA +/* +/* Wietse Venema +/* Google, Inc. +/* 111 8th Avenue +/* New York, NY 10011, USA /*--*/ /* System library. */ -- 2.47.3