From 66f2f64485e97ec9bf7e4bc036079525870151d7 Mon Sep 17 00:00:00 2001 From: Wietse Venema Date: Tue, 5 Jun 2018 00:00:00 -0500 Subject: [PATCH] postfix-3.4-20180605-nonprod --- postfix/HISTORY | 13 +++ postfix/README_FILES/CONNECTION_CACHE_README | 17 ++-- postfix/README_FILES/TLS_README | 38 +++++++++ postfix/html/CONNECTION_CACHE_README.html | 4 + postfix/html/TLS_README.html | 45 +++++++++++ postfix/html/lmtp.8.html | 10 +++ postfix/html/postconf.5.html | 73 +++++++++++------ postfix/html/smtp.8.html | 10 +++ postfix/html/tlsproxy.8.html | 83 ++++++++++---------- postfix/man/man5/postconf.5 | 53 +++++++++---- postfix/man/man8/smtp.8 | 8 ++ postfix/man/man8/tlsproxy.8 | 9 ++- postfix/mantools/postlink | 4 +- postfix/proto/CONNECTION_CACHE_README.html | 4 + postfix/proto/TLS_README.html | 45 +++++++++++ postfix/proto/postconf.proto | 52 +++++++----- postfix/src/global/mail_params.h | 10 +-- postfix/src/global/mail_version.h | 2 +- postfix/src/smtp/lmtp_params.c | 2 +- postfix/src/smtp/smtp.c | 10 ++- postfix/src/smtp/smtp.h | 2 + postfix/src/smtp/smtp_connect.c | 13 ++- postfix/src/smtp/smtp_params.c | 2 +- postfix/src/smtp/smtp_proto.c | 8 +- postfix/src/smtp/smtp_session.c | 2 +- postfix/src/smtp/smtp_tls_policy.c | 13 +++ postfix/src/tlsproxy/tlsproxy.c | 64 ++++++++++----- postfix/src/tlsproxy/tlsproxy_state.c | 3 +- 28 files changed, 446 insertions(+), 153 deletions(-) diff --git a/postfix/HISTORY b/postfix/HISTORY index b856888d3..1c6683657 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -23500,3 +23500,16 @@ Apologies for any names omitted. levels that require no certificate checks. Perhaps it still makes sense to save such sessions for reuse by less sensitive deliveries. Files: smtp/smtp.h smtp/smtp_reuse.c. + +20180604 + + TLS reuse: smtp_tls_connection_reuse boolean parameter, and + corresponding override with "connection_reuse" boolean + attribute in smtp_policy_maps. Files: global/mail_params.h, + smtp.c, smtp.h, smtp_params.c, smtp_proto.c, smtp_session.c, + smtp_tls_policy.c. proto/postconf.proto. mantools/postlink. + +20180605 + + TLS reuse: updated TLS_README and CONNECTION_CACHE_README, + added comments in tlsproxy.c to explain why it works. diff --git a/postfix/README_FILES/CONNECTION_CACHE_README b/postfix/README_FILES/CONNECTION_CACHE_README index 5067f7aea..408d3b54d 100644 --- a/postfix/README_FILES/CONNECTION_CACHE_README +++ b/postfix/README_FILES/CONNECTION_CACHE_README @@ -7,6 +7,9 @@ IInnttrroodduuccttiioonn This document describes the Postfix connection cache implementation, which is available with Postfix version 2.2 and later. +See Client-side TLS connection reuse for how this connection cache is used to +implement multiple deliveries per TLS-encrypted connection. + Topics covered in this document: * What SMTP connection caching can do for you @@ -64,14 +67,14 @@ to access this cache. /-- smtp(8) --> Internet - qmgr(8) | - | - \-- | smtp(8) --> Internet - | - ^ - | + qmgr(8) + | + \-- | smtp(8) --> Internet + | + ^ + | - scache(8) + scache(8) When SMTP connection caching is enabled (see next section), the smtp(8) client does not disconnect after a mail transaction, but gives the connection to the diff --git a/postfix/README_FILES/TLS_README b/postfix/README_FILES/TLS_README index 15b5e52c3..37622d383 100644 --- a/postfix/README_FILES/TLS_README +++ b/postfix/README_FILES/TLS_README @@ -707,6 +707,7 @@ Topics covered in this section: * Configuring TLS in the SMTP/LMTP client * Client-side TLS activity logging * Client-side certificate and private key configuration + * Client-side TLS connection reuse * Client-side TLS session cache * Client TLS limitations * Per-destination TLS policy @@ -1432,6 +1433,43 @@ Example: smtp_tls_CAfile = /etc/postfix/CAcert.pem smtp_tls_CApath = /etc/postfix/certs +CClliieenntt--ssiiddee TTLLSS ccoonnnneeccttiioonn rreeuussee + +Historically, the Postfix SMTP client has supported multiple deliveries per +connection only for plaintext connections. Postfix 3.4 introduces the ability +to make multiple deliveries per TLS-encrypted connection. This is primarily to +improve mail delivery performance for destinations that throttle clients when +they don't combine deliveries. + +To enable multiple deliveries per TLS connection, specify: + + /etc/postfix/main.cf: + smtp_tls_connection_reuse = yes + +Alternatively, specify the attribute "connection_reuse=yes" in an +smtp_tls_policy_maps entry. + +The implementation of TLS connection reuse relies on the same scache(8) service +as used for delivering plaintext SMTP mail, the same tlsproxy(8) daemon as used +by the postscreen(8) service, and relies on the same hints from the qmgr(8) +daemon. See "Postfix Connection Cache" for a description of the underlying +connection reuse infrastructure. + +Initial SMTP handshake: + + smtp(8) -> remote SMTP server + +Reused SMTP/TLS connection, or new SMTP/TLS connection: + + smtp(8) -> tlsproxy(8) -> remote SMTP server + +Cached SMTP/TLS connection: + + scache(8) -> tlsproxy(8) -> remote SMTP server + +As of Postfix 3.4, TLS connection reuse is disabled by default. This may change +once the impact on over-all performance is undestood. + CClliieenntt--ssiiddee TTLLSS sseessssiioonn ccaacchhee The remote SMTP server and the Postfix SMTP client negotiate a session, which diff --git a/postfix/html/CONNECTION_CACHE_README.html b/postfix/html/CONNECTION_CACHE_README.html index b0201dc93..e808180a7 100644 --- a/postfix/html/CONNECTION_CACHE_README.html +++ b/postfix/html/CONNECTION_CACHE_README.html @@ -22,6 +22,10 @@

This document describes the Postfix connection cache implementation, which is available with Postfix version 2.2 and later.

+

See Client-side TLS +connection reuse for how this connection cache is used to +implement multiple deliveries per TLS-encrypted connection.

+

Topics covered in this document: