mirror of
https://github.com/vdukhovni/postfix
synced 2025-08-29 21:27:57 +00:00
postfix-3.5.9
This commit is contained in:
Wietse Venema
Viktor Dukhovni
parent
fd0cba6ac6
commit
0dc6e48004
@ -24882,3 +24882,26 @@ Apologies for any names omitted.
|
||||
subsequent header content to become message body content.
|
||||
Reported by Andreas Weigel, fix by Viktor Dukhovni. File:
|
||||
smtp/smtp_proto.c.
|
||||
|
||||
20210116
|
||||
|
||||
Feature: when a Postfix program makes a DNS query that
|
||||
requests DNSSEC validation (usually for Postfix DANE support)
|
||||
but the DNS response is not DNSSEC validated, Postfix will
|
||||
send a DNS query configured with the "dnssec_probe" parameter
|
||||
to determine if DNSSEC support is available, and logs a
|
||||
warning if it is not. By default, the probe has type "ns"
|
||||
and domain name ".". The probe is sent once per process
|
||||
lifetime. Files: dns/dns.h, dns/dns_lookup.c, dns/dns_sec.c,
|
||||
test_dns_lookup.c, global/mail_params.[hc], mantools/postlink.
|
||||
|
||||
The makedefs script no longer disables DNSSEC when Postfix
|
||||
is built with libc-musl. Instead Postfix will rely on the
|
||||
new dnssec_probe feature, and will log a warning when Postfix
|
||||
requests DNSSEC validation, but the infrastructure does not
|
||||
validate DNSSEC signatures. File: makedefs.
|
||||
|
||||
The default "smtp_tls_dane_insecure_mx_policy = dane" was
|
||||
causing unnecessary dnssec_probe activity. The default is now
|
||||
"dane" when smtp_tls_security_level is "dane", otherwise it is
|
||||
"may". File: global/mail_params.h.
|
||||
|
||||
@ -25,9 +25,50 @@ more recent Eclipse Public License 2.0. Recipients can choose to take
|
||||
the software under the license of their choice. Those who are more
|
||||
comfortable with the IPL can continue with that license.
|
||||
|
||||
Runtime detection of DNSSEC support
|
||||
-----------------------------------
|
||||
|
||||
The Postfix build system will no longer automatically disable DNSSEC
|
||||
support when it determines that Postfix will use libc-musl. This removes
|
||||
the earlier libc-musl workaround for Postfix 3.2.15, 3.3.10, 3.4.12,
|
||||
and 3.5.2.
|
||||
|
||||
Now, when a Postfix process requests DNSSEC support (typically, for
|
||||
Postfix DANE support), the process may do a runtime test to determine if
|
||||
DNSSEC validation is available. DNSSEC support may be broken because of
|
||||
local configuration, libc incompatibility, or other infrastructure issues.
|
||||
|
||||
Background: DNSSEC validation is needed for Postfix DANE support;
|
||||
this ensures that Postfix receives TLSA records with secure TLS
|
||||
server certificate info. When DNSSEC validation is unavailable,
|
||||
mail deliveries using opportunistic DANE will not be protected by
|
||||
server certificate info in TLSA records, and mail deliveries using
|
||||
mandatory DANE will not be made at all.
|
||||
|
||||
The dnssec_probe parameter specifies the DNS query type (default:
|
||||
"ns") and DNS query name (default: ".") that Postfix may use to
|
||||
determine whether DNSSEC validation is available. Specify an empty
|
||||
value to disable this feature.
|
||||
|
||||
By default, a Postfix process will send a DNSSEC probe after 1) the
|
||||
process made a DNS query that requested DNSSEC validation, 2) the
|
||||
process did not receive a DNSSEC validated response to this query
|
||||
or to an earlier query, and 3) the process did not already send a
|
||||
DNSSEC probe.
|
||||
|
||||
When the DNSSEC probe has no response, or when the response is not
|
||||
DNSSEC validated, Postfix logs a warning that DNSSEC validation may
|
||||
be unavailable. Examples:
|
||||
|
||||
warning: DNSSEC validation may be unavailable
|
||||
warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated
|
||||
warning: reason: dnssec_probe 'ns:.' received no response: Server failure
|
||||
|
||||
This feature was backported from Postfix 3.6.
|
||||
|
||||
libc-musl workaround for Postfix 3.2.15, 3.3.10, 3.4.12, and 3.5.2
|
||||
------------------------------------------------------------------
|
||||
|
||||
|
||||
Security: this release disables DANE support on Linux systems with
|
||||
libc-musl, because libc-musl provides no indication whether DNS
|
||||
responses are authentic. This broke DANE support without a clear
|
||||
|
||||
@ -365,6 +365,13 @@ SMTP(8) SMTP(8)
|
||||
The email address form that will be used in non-debug logging
|
||||
(info, warning, etc.).
|
||||
|
||||
Available in Postfix 3.5.9 and later:
|
||||
|
||||
<b><a href="postconf.5.html#dnssec_probe">dnssec_probe</a> (ns:.)</b>
|
||||
The DNS query type (default: "ns") and DNS query name (default:
|
||||
".") that Postfix may use to determine whether DNSSEC validation
|
||||
is available.
|
||||
|
||||
<b>MIME PROCESSING CONTROLS</b>
|
||||
Available in Postfix version 2.0 and later:
|
||||
|
||||
|
||||
@ -3029,6 +3029,66 @@ service performs DNS white/blacklist lookups. </p>
|
||||
<p> This feature is available in Postfix 2.8 and later. </p>
|
||||
|
||||
|
||||
</DD>
|
||||
|
||||
<DT><b><a name="dnssec_probe">dnssec_probe</a>
|
||||
(default: ns:.)</b></DT><DD>
|
||||
|
||||
<p> The DNS query type (default: "ns") and DNS query name (default:
|
||||
".") that Postfix may use to determine whether DNSSEC validation
|
||||
is available.
|
||||
</p>
|
||||
|
||||
<p> Background: DNSSEC validation is needed for Postfix DANE support;
|
||||
this ensures that Postfix receives TLSA records with secure TLS
|
||||
server certificate info. When DNSSEC validation is unavailable,
|
||||
mail deliveries using <i>opportunistic</i> DANE will not be protected
|
||||
by server certificate info in TLSA records, and mail deliveries
|
||||
using <i>mandatory</i> DANE will not be made at all. </p>
|
||||
|
||||
<p> By default, a Postfix process will send a DNSSEC probe after
|
||||
1) the process made a DNS query that requested DNSSEC validation,
|
||||
2) the process did not receive a DNSSEC validated response to this
|
||||
query or to an earlier query, and 3) the process did not already
|
||||
send a DNSSEC probe. <p>
|
||||
|
||||
<p> When the DNSSEC probe has no response, or when the response is
|
||||
not DNSSEC validated, Postfix logs a warning that DNSSEC validation
|
||||
may be unavailable. </p>
|
||||
|
||||
<p> Example: </p>
|
||||
|
||||
<pre>
|
||||
warning: DNSSEC validation may be unavailable
|
||||
warning: reason: <a href="postconf.5.html#dnssec_probe">dnssec_probe</a> 'ns:.' received a response that is not DNSSEC validated
|
||||
warning: reason: <a href="postconf.5.html#dnssec_probe">dnssec_probe</a> 'ns:.' received no response: Server failure
|
||||
</pre>
|
||||
|
||||
<p> Possible reasons why DNSSEC validation may be unavailable: </p>
|
||||
|
||||
<ul>
|
||||
|
||||
<li> The local /etc/resolv.conf file specifies a DNS resolver that
|
||||
does not validate DNSSEC signatures (that's
|
||||
$<a href="postconf.5.html#queue_directory">queue_directory</a>/etc/resolv.conf when a Postfix daemon runs in a
|
||||
chroot jail).
|
||||
|
||||
<li> The local system library does not pass on the "DNSSEC validated"
|
||||
bit to Postfix, or Postfix does not know how to ask the library to
|
||||
do that.
|
||||
|
||||
</ul>
|
||||
|
||||
<p> By default, the DNSSEC probe asks for the DNS root zone NS
|
||||
records, because resolvers should always have that information
|
||||
cached. If Postfix runs on a network where the DNS root zone is not
|
||||
reachable, specify a different probe, or specify an empty <a href="postconf.5.html#dnssec_probe">dnssec_probe</a>
|
||||
value to disable the feature. </p>
|
||||
|
||||
<p> This feature was backported from Postfix 3.6 to Postfix versions
|
||||
3.5.9, 3.4.19, 3.3.16. 3.2.21. </p>
|
||||
|
||||
|
||||
</DD>
|
||||
|
||||
<DT><b><a name="dont_remove">dont_remove</a>
|
||||
@ -12377,7 +12437,7 @@ TLS connection reuse</a>" for background details. </p>
|
||||
</DD>
|
||||
|
||||
<DT><b><a name="smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a>
|
||||
(default: dane)</b></DT><DD>
|
||||
(default: see "postconf -d" output)</b></DT><DD>
|
||||
|
||||
<p> The TLS policy for MX hosts with "secure" TLSA records when the
|
||||
nexthop destination security level is <b>dane</b>, but the MX
|
||||
@ -12401,6 +12461,12 @@ authentication succeeds, it will be logged only as "Trusted", not
|
||||
"Verified", because the MX host name could have been forged. </dd>
|
||||
</dl>
|
||||
|
||||
<p> The default setting for Postfix ≥ 3.6 is "dane" with
|
||||
"<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = dane", otherwise "may". This behavior
|
||||
was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21.
|
||||
With earlier
|
||||
Postfix versions the default setting was always "dane". </p>
|
||||
|
||||
<p> Though with "insecure" MX records an active attacker can
|
||||
compromise SMTP transport security by returning forged MX records,
|
||||
such attacks are "tamper-evident" since any forged MX hostnames
|
||||
|
||||
@ -365,6 +365,13 @@ SMTP(8) SMTP(8)
|
||||
The email address form that will be used in non-debug logging
|
||||
(info, warning, etc.).
|
||||
|
||||
Available in Postfix 3.5.9 and later:
|
||||
|
||||
<b><a href="postconf.5.html#dnssec_probe">dnssec_probe</a> (ns:.)</b>
|
||||
The DNS query type (default: "ns") and DNS query name (default:
|
||||
".") that Postfix may use to determine whether DNSSEC validation
|
||||
is available.
|
||||
|
||||
<b>MIME PROCESSING CONTROLS</b>
|
||||
Available in Postfix version 2.0 and later:
|
||||
|
||||
|
||||
@ -228,19 +228,6 @@ case $# in
|
||||
*) echo usage: $0 [system release] 1>&2; exit 1;;
|
||||
esac
|
||||
|
||||
case "$SYSTEM" in
|
||||
Linux)
|
||||
case "`PATH=/bin:/usr/bin ldd /bin/sh`" in
|
||||
*-musl-*)
|
||||
case "$CCARGS" in
|
||||
*-DNO_DNSSEC*) ;;
|
||||
*) echo Warning: libc-musl breaks DANE/TLSA security. 1>&2
|
||||
echo This build will not support DANE/TLSA. 1>&2
|
||||
CCARGS="$CCARGS -DNO_DNSSEC";;
|
||||
esac;;
|
||||
esac;;
|
||||
esac
|
||||
|
||||
case "$SYSTEM.$RELEASE" in
|
||||
SCO_SV.3.2) SYSTYPE=SCO5
|
||||
# Use the native compiler by default
|
||||
|
||||
@ -1897,6 +1897,60 @@ The name of the \fBdnsblog\fR(8) service entry in master.cf. This
|
||||
service performs DNS white/blacklist lookups.
|
||||
.PP
|
||||
This feature is available in Postfix 2.8 and later.
|
||||
.SH dnssec_probe (default: ns:.)
|
||||
The DNS query type (default: "ns") and DNS query name (default:
|
||||
".") that Postfix may use to determine whether DNSSEC validation
|
||||
is available.
|
||||
.PP
|
||||
Background: DNSSEC validation is needed for Postfix DANE support;
|
||||
this ensures that Postfix receives TLSA records with secure TLS
|
||||
server certificate info. When DNSSEC validation is unavailable,
|
||||
mail deliveries using \fIopportunistic\fR DANE will not be protected
|
||||
by server certificate info in TLSA records, and mail deliveries
|
||||
using \fImandatory\fR DANE will not be made at all.
|
||||
.PP
|
||||
By default, a Postfix process will send a DNSSEC probe after
|
||||
1) the process made a DNS query that requested DNSSEC validation,
|
||||
2) the process did not receive a DNSSEC validated response to this
|
||||
query or to an earlier query, and 3) the process did not already
|
||||
send a DNSSEC probe.
|
||||
.PP
|
||||
When the DNSSEC probe has no response, or when the response is
|
||||
not DNSSEC validated, Postfix logs a warning that DNSSEC validation
|
||||
may be unavailable.
|
||||
.PP
|
||||
Example:
|
||||
.PP
|
||||
.nf
|
||||
.na
|
||||
.ft C
|
||||
warning: DNSSEC validation may be unavailable
|
||||
warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated
|
||||
warning: reason: dnssec_probe 'ns:.' received no response: Server failure
|
||||
.fi
|
||||
.ad
|
||||
.ft R
|
||||
.PP
|
||||
Possible reasons why DNSSEC validation may be unavailable:
|
||||
.IP \(bu
|
||||
The local /etc/resolv.conf file specifies a DNS resolver that
|
||||
does not validate DNSSEC signatures (that's
|
||||
$queue_directory/etc/resolv.conf when a Postfix daemon runs in a
|
||||
chroot jail).
|
||||
.IP \(bu
|
||||
The local system library does not pass on the "DNSSEC validated"
|
||||
bit to Postfix, or Postfix does not know how to ask the library to
|
||||
do that.
|
||||
.br
|
||||
.PP
|
||||
By default, the DNSSEC probe asks for the DNS root zone NS
|
||||
records, because resolvers should always have that information
|
||||
cached. If Postfix runs on a network where the DNS root zone is not
|
||||
reachable, specify a different probe, or specify an empty dnssec_probe
|
||||
value to disable the feature.
|
||||
.PP
|
||||
This feature was backported from Postfix 3.6 to Postfix versions
|
||||
3.5.9, 3.4.19, 3.3.16. 3.2.21.
|
||||
.SH dont_remove (default: 0)
|
||||
Don't remove queue files and save them to the "saved" mail queue.
|
||||
This is a debugging aid. To inspect the envelope information and
|
||||
@ -7921,7 +7975,7 @@ See "Client\-side
|
||||
TLS connection reuse" for background details.
|
||||
.PP
|
||||
This feature is available in Postfix 3.4 and later.
|
||||
.SH smtp_tls_dane_insecure_mx_policy (default: dane)
|
||||
.SH smtp_tls_dane_insecure_mx_policy (default: see "postconf \-d" output)
|
||||
The TLS policy for MX hosts with "secure" TLSA records when the
|
||||
nexthop destination security level is \fBdane\fR, but the MX
|
||||
record was found via an "insecure" MX lookup. The choices are:
|
||||
@ -7942,6 +7996,12 @@ authentication succeeds, it will be logged only as "Trusted", not
|
||||
"Verified", because the MX host name could have been forged.
|
||||
.br
|
||||
.br
|
||||
The default setting for Postfix >= 3.6 is "dane" with
|
||||
"smtp_tls_security_level = dane", otherwise "may". This behavior
|
||||
was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21.
|
||||
With earlier
|
||||
Postfix versions the default setting was always "dane".
|
||||
.PP
|
||||
Though with "insecure" MX records an active attacker can
|
||||
compromise SMTP transport security by returning forged MX records,
|
||||
such attacks are "tamper\-evident" since any forged MX hostnames
|
||||
|
||||
@ -356,6 +356,12 @@ Available in Postfix 3.5 and later:
|
||||
.IP "\fBinfo_log_address_format (external)\fR"
|
||||
The email address form that will be used in non\-debug logging
|
||||
(info, warning, etc.).
|
||||
.PP
|
||||
Available in Postfix 3.5.9 and later:
|
||||
.IP "\fBdnssec_probe (ns:.)\fR"
|
||||
The DNS query type (default: "ns") and DNS query name (default:
|
||||
".") that Postfix may use to determine whether DNSSEC validation
|
||||
is available.
|
||||
.SH "MIME PROCESSING CONTROLS"
|
||||
.na
|
||||
.nf
|
||||
|
||||
@ -695,6 +695,7 @@ while (<>) {
|
||||
s;\bsmtp_per_record_deadline\b;<a href="postconf.5.html#smtp_per_record_deadline">$&</a>;g;
|
||||
s;\bsmtp_send_dummy_mail_auth\b;<a href="postconf.5.html#smtp_send_dummy_mail_auth">$&</a>;g;
|
||||
s;\bsmtp_balance_inet_protocols\b;<a href="postconf.5.html#smtp_balance_inet_protocols">$&</a>;g;
|
||||
s;\bdnssec_probe\b;<a href="postconf.5.html#dnssec_probe">$&</a>;g;
|
||||
s;\bsmtp_tls_connection_reuse\b;<a href="postconf.5.html#smtp_tls_connection_reuse">$&</a>;g;
|
||||
s;\blmtp_tls_connection_reuse\b;<a href="postconf.5.html#lmtp_tls_connection_reuse">$&</a>;g;
|
||||
s;\bsmtpd_enforce_tls\b;<a href="postconf.5.html#smtpd_enforce_tls">$&</a>;g;
|
||||
|
||||
@ -16815,7 +16815,7 @@ clients). </p>
|
||||
This feature is available in Postfix 3.1 and later.
|
||||
</p>
|
||||
|
||||
%PARAM smtp_tls_dane_insecure_mx_policy dane
|
||||
%PARAM smtp_tls_dane_insecure_mx_policy see "postconf -d" output
|
||||
|
||||
<p> The TLS policy for MX hosts with "secure" TLSA records when the
|
||||
nexthop destination security level is <b>dane</b>, but the MX
|
||||
@ -16839,6 +16839,12 @@ authentication succeeds, it will be logged only as "Trusted", not
|
||||
"Verified", because the MX host name could have been forged. </dd>
|
||||
</dl>
|
||||
|
||||
<p> The default setting for Postfix ≥ 3.6 is "dane" with
|
||||
"smtp_tls_security_level = dane", otherwise "may". This behavior
|
||||
was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21.
|
||||
With earlier
|
||||
Postfix versions the default setting was always "dane". </p>
|
||||
|
||||
<p> Though with "insecure" MX records an active attacker can
|
||||
compromise SMTP transport security by returning forged MX records,
|
||||
such attacks are "tamper-evident" since any forged MX hostnames
|
||||
@ -17698,3 +17704,59 @@ with quotes and backslashes. An attacker should not be able to use
|
||||
such games to circumvent Postfix access policies. </p>
|
||||
|
||||
<p> This feature is available in Postfix 3.5 and later. </p>
|
||||
|
||||
%PARAM dnssec_probe ns:.
|
||||
|
||||
<p> The DNS query type (default: "ns") and DNS query name (default:
|
||||
".") that Postfix may use to determine whether DNSSEC validation
|
||||
is available.
|
||||
</p>
|
||||
|
||||
<p> Background: DNSSEC validation is needed for Postfix DANE support;
|
||||
this ensures that Postfix receives TLSA records with secure TLS
|
||||
server certificate info. When DNSSEC validation is unavailable,
|
||||
mail deliveries using <i>opportunistic</i> DANE will not be protected
|
||||
by server certificate info in TLSA records, and mail deliveries
|
||||
using <i>mandatory</i> DANE will not be made at all. </p>
|
||||
|
||||
<p> By default, a Postfix process will send a DNSSEC probe after
|
||||
1) the process made a DNS query that requested DNSSEC validation,
|
||||
2) the process did not receive a DNSSEC validated response to this
|
||||
query or to an earlier query, and 3) the process did not already
|
||||
send a DNSSEC probe. <p>
|
||||
|
||||
<p> When the DNSSEC probe has no response, or when the response is
|
||||
not DNSSEC validated, Postfix logs a warning that DNSSEC validation
|
||||
may be unavailable. </p>
|
||||
|
||||
<p> Example: </p>
|
||||
|
||||
<pre>
|
||||
warning: DNSSEC validation may be unavailable
|
||||
warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated
|
||||
warning: reason: dnssec_probe 'ns:.' received no response: Server failure
|
||||
</pre>
|
||||
|
||||
<p> Possible reasons why DNSSEC validation may be unavailable: </p>
|
||||
|
||||
<ul>
|
||||
|
||||
<li> The local /etc/resolv.conf file specifies a DNS resolver that
|
||||
does not validate DNSSEC signatures (that's
|
||||
$queue_directory/etc/resolv.conf when a Postfix daemon runs in a
|
||||
chroot jail).
|
||||
|
||||
<li> The local system library does not pass on the "DNSSEC validated"
|
||||
bit to Postfix, or Postfix does not know how to ask the library to
|
||||
do that.
|
||||
|
||||
</ul>
|
||||
|
||||
<p> By default, the DNSSEC probe asks for the DNS root zone NS
|
||||
records, because resolvers should always have that information
|
||||
cached. If Postfix runs on a network where the DNS root zone is not
|
||||
reachable, specify a different probe, or specify an empty dnssec_probe
|
||||
value to disable the feature. </p>
|
||||
|
||||
<p> This feature was backported from Postfix 3.6 to Postfix versions
|
||||
3.5.9, 3.4.19, 3.3.16. 3.2.21. </p>
|
||||
|
||||
@ -1,10 +1,10 @@
|
||||
SHELL = /bin/sh
|
||||
SRCS = dns_lookup.c dns_rr.c dns_strerror.c dns_strtype.c dns_rr_to_pa.c \
|
||||
dns_sa_to_rr.c dns_rr_eq_sa.c dns_rr_to_sa.c dns_strrecord.c \
|
||||
dns_rr_filter.c dns_str_resflags.c
|
||||
dns_rr_filter.c dns_str_resflags.c dns_sec.c
|
||||
OBJS = dns_lookup.o dns_rr.o dns_strerror.o dns_strtype.o dns_rr_to_pa.o \
|
||||
dns_sa_to_rr.o dns_rr_eq_sa.o dns_rr_to_sa.o dns_strrecord.o \
|
||||
dns_rr_filter.o dns_str_resflags.o
|
||||
dns_rr_filter.o dns_str_resflags.o dns_sec.o
|
||||
HDRS = dns.h
|
||||
TESTSRC = test_dns_lookup.c test_alias_token.c
|
||||
DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE)
|
||||
@ -76,7 +76,7 @@ update: $(LIB_DIR)/$(LIB) $(HDRS)
|
||||
done
|
||||
cd $(INC_DIR); chmod 644 $(HDRS)
|
||||
|
||||
test_dns_lookup: test_dns_lookup.c $(LIB) $(LIBS)
|
||||
test_dns_lookup: test_dns_lookup.c all $(LIB) $(LIBS)
|
||||
$(CC) $(CFLAGS) -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS)
|
||||
|
||||
dns_rr_to_pa: $(LIB) $(LIBS)
|
||||
@ -346,6 +346,18 @@ dns_sa_to_rr.o: ../../include/vbuf.h
|
||||
dns_sa_to_rr.o: ../../include/vstring.h
|
||||
dns_sa_to_rr.o: dns.h
|
||||
dns_sa_to_rr.o: dns_sa_to_rr.c
|
||||
dns_sec.o: ../../include/check_arg.h
|
||||
dns_sec.o: ../../include/mail_params.h
|
||||
dns_sec.o: ../../include/msg.h
|
||||
dns_sec.o: ../../include/myaddrinfo.h
|
||||
dns_sec.o: ../../include/mymalloc.h
|
||||
dns_sec.o: ../../include/sock_addr.h
|
||||
dns_sec.o: ../../include/split_at.h
|
||||
dns_sec.o: ../../include/sys_defs.h
|
||||
dns_sec.o: ../../include/vbuf.h
|
||||
dns_sec.o: ../../include/vstring.h
|
||||
dns_sec.o: dns.h
|
||||
dns_sec.o: dns_sec.c
|
||||
dns_str_resflags.o: ../../include/check_arg.h
|
||||
dns_str_resflags.o: ../../include/myaddrinfo.h
|
||||
dns_str_resflags.o: ../../include/name_mask.h
|
||||
|
||||
@ -244,7 +244,12 @@ extern int dns_lookup_rv(const char *, unsigned, DNS_RR **, VSTRING *,
|
||||
(lflags), (ltype))
|
||||
|
||||
/*
|
||||
* Request flags.
|
||||
* The dns_lookup() rflag that requests DNSSEC validation.
|
||||
*/
|
||||
#define DNS_WANT_DNSSEC_VALIDATION(rflags) ((rflags) & RES_USE_DNSSEC)
|
||||
|
||||
/*
|
||||
* lflags.
|
||||
*/
|
||||
#define DNS_REQ_FLAG_STOP_OK (1<<0)
|
||||
#define DNS_REQ_FLAG_STOP_INVAL (1<<1)
|
||||
@ -309,6 +314,18 @@ extern int dns_rr_filter_execute(DNS_RR **);
|
||||
*/
|
||||
const char *dns_str_resflags(unsigned long);
|
||||
|
||||
/*
|
||||
* dns_sec.c.
|
||||
*/
|
||||
#define DNS_SEC_FLAG_AVAILABLE (1<<0) /* got some DNSSEC validated reply */
|
||||
#define DNS_SEC_FLAG_DONT_PROBE (1<<1) /* probe already sent, or disabled */
|
||||
|
||||
#define DNS_SEC_STATS_SET(flags) (dns_sec_stats |= (flags))
|
||||
#define DNS_SEC_STATS_TEST(flags) (dns_sec_stats & (flags))
|
||||
|
||||
extern int dns_sec_stats; /* See DNS_SEC_FLAG_XXX above */
|
||||
extern void dns_sec_probe(int);
|
||||
|
||||
/* LICENSE
|
||||
/* .ad
|
||||
/* .fi
|
||||
|
||||
@ -171,6 +171,12 @@
|
||||
/* Pointer to storage for the reply RCODE value. This gives
|
||||
/* more detailed information than DNS_FAIL, DNS_RETRY, etc.
|
||||
/* DIAGNOSTICS
|
||||
/* If DNSSEC validation is requested but the response is not
|
||||
/* DNSSEC validated, dns_lookup() will send a one-time probe
|
||||
/* query as configured with the \fBdnssec_probe\fR configuration
|
||||
/* parameter, and will log a warning when the probe response
|
||||
/* was not DNSSEC validated.
|
||||
/* .PP
|
||||
/* dns_lookup() returns one of the following codes and sets the
|
||||
/* \fIwhy\fR argument accordingly:
|
||||
/* .IP DNS_OK
|
||||
@ -463,7 +469,7 @@ static int dns_query(const char *name, int type, unsigned flags,
|
||||
*/
|
||||
#define XTRA_FLAGS (RES_USE_EDNS0 | RES_TRUSTAD)
|
||||
|
||||
if (flags & RES_USE_DNSSEC)
|
||||
if (DNS_WANT_DNSSEC_VALIDATION(flags))
|
||||
flags |= (RES_USE_EDNS0 | RES_TRUSTAD);
|
||||
|
||||
/*
|
||||
@ -510,6 +516,8 @@ static int dns_query(const char *name, int type, unsigned flags,
|
||||
_res.options |= saved_options;
|
||||
reply_header = (HEADER *) reply->buf;
|
||||
reply->rcode = reply_header->rcode;
|
||||
if ((reply->dnssec_ad = !!reply_header->ad) != 0)
|
||||
DNS_SEC_STATS_SET(DNS_SEC_FLAG_AVAILABLE);
|
||||
if (h_errno != 0) {
|
||||
if (why)
|
||||
vstring_sprintf(why, "Host or domain name not found. "
|
||||
@ -561,13 +569,8 @@ static int dns_query(const char *name, int type, unsigned flags,
|
||||
|
||||
/*
|
||||
* Initialize the reply structure. Some structure members are filled on
|
||||
* the fly while the reply is being parsed. Coerce AD bit to boolean.
|
||||
* the fly while the reply is being parsed.
|
||||
*/
|
||||
#if RES_USE_DNSSEC != 0
|
||||
reply->dnssec_ad = (flags & RES_USE_DNSSEC) ? !!reply_header->ad : 0;
|
||||
#else
|
||||
reply->dnssec_ad = 0;
|
||||
#endif
|
||||
SET_HAVE_DNS_REPLY_PACKET(reply, len);
|
||||
reply->query_start = reply->buf + sizeof(HEADER);
|
||||
reply->answer_start = 0;
|
||||
@ -885,7 +888,9 @@ static int dns_get_answer(const char *orig_name, DNS_REPLY *reply, int type,
|
||||
CORRUPT(DNS_RETRY);
|
||||
if ((status = dns_get_fixed(pos, &fixed)) != DNS_OK)
|
||||
CORRUPT(status);
|
||||
if (!valid_rr_name(rr_name, "resource name", fixed.type, reply))
|
||||
if (strcmp(orig_name, ".") == 0 && *rr_name == 0)
|
||||
/* Allow empty response name for root queries. */ ;
|
||||
else if (!valid_rr_name(rr_name, "resource name", fixed.type, reply))
|
||||
CORRUPT(DNS_INVAL);
|
||||
if (fqdn)
|
||||
vstring_strcpy(fqdn, rr_name);
|
||||
@ -973,7 +978,7 @@ int dns_lookup_x(const char *name, unsigned type, unsigned flags,
|
||||
/*
|
||||
* The Linux resolver misbehaves when given an invalid domain name.
|
||||
*/
|
||||
if (!valid_hostname(name, DONT_GRIPE)) {
|
||||
if (strcmp(name, ".") && !valid_hostname(name, DONT_GRIPE)) {
|
||||
if (why)
|
||||
vstring_sprintf(why,
|
||||
"Name service error for %s: invalid host or domain name",
|
||||
@ -1010,6 +1015,10 @@ int dns_lookup_x(const char *name, unsigned type, unsigned flags,
|
||||
(void) dns_get_answer(orig_name, &reply, T_SOA, rrlist, fqdn,
|
||||
cname, c_len, &maybe_secure);
|
||||
}
|
||||
if (DNS_WANT_DNSSEC_VALIDATION(flags)
|
||||
&& !DNS_SEC_STATS_TEST(DNS_SEC_FLAG_AVAILABLE | \
|
||||
DNS_SEC_FLAG_DONT_PROBE))
|
||||
dns_sec_probe(flags); /* XXX Clobbers 'reply' */
|
||||
return (status);
|
||||
}
|
||||
|
||||
@ -1019,6 +1028,10 @@ int dns_lookup_x(const char *name, unsigned type, unsigned flags,
|
||||
*/
|
||||
status = dns_get_answer(orig_name, &reply, type, rrlist, fqdn,
|
||||
cname, c_len, &maybe_secure);
|
||||
if (DNS_WANT_DNSSEC_VALIDATION(flags)
|
||||
&& !DNS_SEC_STATS_TEST(DNS_SEC_FLAG_AVAILABLE | \
|
||||
DNS_SEC_FLAG_DONT_PROBE))
|
||||
dns_sec_probe(flags); /* XXX Clobbers 'reply' */
|
||||
switch (status) {
|
||||
default:
|
||||
if (why)
|
||||
|
||||
144
postfix/src/dns/dns_sec.c
Normal file
144
postfix/src/dns/dns_sec.c
Normal file
@ -0,0 +1,144 @@
|
||||
/*++
|
||||
/* NAME
|
||||
/* dns_sec 3
|
||||
/* SUMMARY
|
||||
/* DNSSEC validation availability
|
||||
/* SYNOPSIS
|
||||
/* #include <dns.h>
|
||||
/*
|
||||
/* DNS_SEC_STATS_SET(
|
||||
/* int flags)
|
||||
/*
|
||||
/* DNS_SEC_STATS_TEST(
|
||||
/* int flags)
|
||||
/*
|
||||
/* void dns_sec_probe(
|
||||
/* int rflags)
|
||||
/* DESCRIPTION
|
||||
/* This module maintains information about the availability of
|
||||
/* DNSSEC validation, in global flags that summarize
|
||||
/* process-lifetime history.
|
||||
/* .IP DNS_SEC_FLAG_AVAILABLE
|
||||
/* The process has received at least one DNSSEC validated
|
||||
/* response to a query that requested DNSSEC validation.
|
||||
/* .IP DNS_SEC_FLAG_DONT_PROBE
|
||||
/* The process has sent a DNSSEC probe (see below), or DNSSEC
|
||||
/* probing is disabled by configuration.
|
||||
/* .PP
|
||||
/* DNS_SEC_STATS_SET() sets one or more DNS_SEC_FLAG_* flags,
|
||||
/* and DNS_SEC_STATS_TEST() returns non-zero if any of the
|
||||
/* specified flags is set.
|
||||
/*
|
||||
/* dns_sec_probe() generates a query to the target specified
|
||||
/* with the \fBdnssec_probe\fR configuration parameter. It
|
||||
/* sets the DNS_SEC_FLAG_DONT_PROBE flag, and it calls
|
||||
/* dns_lookup() which sets DNS_SEC_FLAG_AVAILABLE if it receives
|
||||
/* a DNSSEC validated response. Preconditions:
|
||||
/* .IP \(bu
|
||||
/* The rflags argument must request DNSSEC validation (in the
|
||||
/* same manner as dns_lookup() rflags argument).
|
||||
/* .IP \(bu
|
||||
/* The DNS_SEC_FLAG_AVAILABLE and DNS_SEC_FLAG_DONT_PROBE
|
||||
/* flags must be false.
|
||||
/* LICENSE
|
||||
/* .ad
|
||||
/* .fi
|
||||
/* The Secure Mailer license must be distributed with this software.
|
||||
/* AUTHOR(S)
|
||||
/* Wietse Venema
|
||||
/* Google, Inc.
|
||||
/* 111 8th Avenue
|
||||
/* New York, NY 10011, USA
|
||||
/*--*/
|
||||
|
||||
#include <sys_defs.h>
|
||||
|
||||
/*
|
||||
* Utility library.
|
||||
*/
|
||||
#include <msg.h>
|
||||
#include <mymalloc.h>
|
||||
#include <split_at.h>
|
||||
#include <vstring.h>
|
||||
|
||||
/*
|
||||
* Global library.
|
||||
*/
|
||||
#include <mail_params.h>
|
||||
|
||||
/*
|
||||
* DNS library.
|
||||
*/
|
||||
#include <dns.h>
|
||||
|
||||
int dns_sec_stats;
|
||||
|
||||
/* dns_sec_probe - send a probe to establish DNSSEC viability */
|
||||
|
||||
void dns_sec_probe(int rflags)
|
||||
{
|
||||
const char myname[] = "dns_sec_probe";
|
||||
char *saved_dnssec_probe;
|
||||
char *qname;
|
||||
int qtype;
|
||||
DNS_RR *rrlist = 0;
|
||||
int dns_status;
|
||||
VSTRING *why;
|
||||
|
||||
/*
|
||||
* Sanity checks.
|
||||
*/
|
||||
if (!DNS_WANT_DNSSEC_VALIDATION(rflags))
|
||||
msg_panic("%s: DNSSEC is not requested", myname);
|
||||
if (DNS_SEC_STATS_TEST(DNS_SEC_FLAG_DONT_PROBE))
|
||||
msg_panic("%s: DNSSEC probe was already sent, or probing is disabled",
|
||||
myname);
|
||||
if (DNS_SEC_STATS_TEST(DNS_SEC_FLAG_AVAILABLE))
|
||||
msg_panic("%s: already have validated DNS response", myname);
|
||||
|
||||
/*
|
||||
* Don't recurse.
|
||||
*/
|
||||
DNS_SEC_STATS_SET(DNS_SEC_FLAG_DONT_PROBE);
|
||||
|
||||
/*
|
||||
* Don't probe.
|
||||
*/
|
||||
if (*var_dnssec_probe == 0)
|
||||
return;
|
||||
|
||||
/*
|
||||
* Parse the probe spec. Format is type:resource.
|
||||
*/
|
||||
saved_dnssec_probe = mystrdup(var_dnssec_probe);
|
||||
if ((qname = split_at(saved_dnssec_probe, ':')) == 0 || *qname == 0
|
||||
|| (qtype = dns_type(saved_dnssec_probe)) == 0)
|
||||
msg_fatal("malformed %s value: %s format is qtype:qname",
|
||||
VAR_DNSSEC_PROBE, var_dnssec_probe);
|
||||
|
||||
why = vstring_alloc(100);
|
||||
dns_status = dns_lookup(qname, qtype, rflags, &rrlist, (VSTRING *) 0, why);
|
||||
if (!DNS_SEC_STATS_TEST(DNS_SEC_FLAG_AVAILABLE))
|
||||
msg_warn("DNSSEC validation may be unavailable");
|
||||
else if (msg_verbose)
|
||||
msg_info(VAR_DNSSEC_PROBE
|
||||
" '%s' received a response that is DNSSEC validated",
|
||||
var_dnssec_probe);
|
||||
switch (dns_status) {
|
||||
default:
|
||||
if (!DNS_SEC_STATS_TEST(DNS_SEC_FLAG_AVAILABLE))
|
||||
msg_warn("reason: " VAR_DNSSEC_PROBE
|
||||
" '%s' received a response that is not DNSSEC validated",
|
||||
var_dnssec_probe);
|
||||
if (rrlist)
|
||||
dns_rr_free(rrlist);
|
||||
break;
|
||||
case DNS_RETRY:
|
||||
case DNS_FAIL:
|
||||
msg_warn("reason: " VAR_DNSSEC_PROBE " '%s' received no response: %s",
|
||||
var_dnssec_probe, vstring_str(why));
|
||||
break;
|
||||
}
|
||||
myfree(saved_dnssec_probe);
|
||||
vstring_free(why);
|
||||
}
|
||||
@ -77,6 +77,9 @@ int main(int argc, char **argv)
|
||||
int ch;
|
||||
int lflags = DNS_REQ_FLAG_NONE;
|
||||
|
||||
if (var_dnssec_probe == 0)
|
||||
var_dnssec_probe = mystrdup(DEF_DNSSEC_PROBE);
|
||||
|
||||
msg_vstream_init(argv[0], VSTREAM_ERR);
|
||||
while ((ch = GETOPT(argc, argv, "f:npv")) > 0) {
|
||||
switch (ch) {
|
||||
|
||||
@ -152,6 +152,8 @@
|
||||
/* char *var_maillog_file_comp;
|
||||
/* char *var_maillog_file_stamp;
|
||||
/* char *var_postlog_service;
|
||||
/*
|
||||
/* char *var_dnssec_probe;
|
||||
/* DESCRIPTION
|
||||
/* This module (actually the associated include file) defines
|
||||
/* the names and defaults of all mail configuration parameters.
|
||||
@ -362,6 +364,8 @@ char *var_maillog_file_comp;
|
||||
char *var_maillog_file_stamp;
|
||||
char *var_postlog_service;
|
||||
|
||||
char *var_dnssec_probe;
|
||||
|
||||
const char null_format_string[1] = "";
|
||||
|
||||
/*
|
||||
@ -689,6 +693,7 @@ void mail_params_init()
|
||||
VAR_MAILLOG_FILE_COMP, DEF_MAILLOG_FILE_COMP, &var_maillog_file_comp, 1, 0,
|
||||
VAR_MAILLOG_FILE_STAMP, DEF_MAILLOG_FILE_STAMP, &var_maillog_file_stamp, 1, 0,
|
||||
VAR_POSTLOG_SERVICE, DEF_POSTLOG_SERVICE, &var_postlog_service, 1, 0,
|
||||
VAR_DNSSEC_PROBE, DEF_DNSSEC_PROBE, &var_dnssec_probe, 0, 0,
|
||||
0,
|
||||
};
|
||||
static const CONFIG_BOOL_TABLE first_bool_defaults[] = {
|
||||
|
||||
@ -1617,7 +1617,7 @@ extern bool var_smtp_tls_force_tlsa;
|
||||
|
||||
/* SMTP only */
|
||||
#define VAR_SMTP_TLS_INSECURE_MX_POLICY "smtp_tls_dane_insecure_mx_policy"
|
||||
#define DEF_SMTP_TLS_INSECURE_MX_POLICY "dane"
|
||||
#define DEF_SMTP_TLS_INSECURE_MX_POLICY "${{$smtp_tls_security_level} == {dane} ? {dane} : {may}}"
|
||||
extern char *var_smtp_tls_insecure_mx_policy;
|
||||
|
||||
/*
|
||||
@ -4202,6 +4202,13 @@ extern int var_postlogd_watchdog;
|
||||
#define DEF_INFO_LOG_ADDR_FORM INFO_LOG_ADDR_FORM_NAME_EXTERNAL
|
||||
extern char *var_info_log_addr_form;
|
||||
|
||||
/*
|
||||
* DNSSEC probing, to find out if DNSSEC validation is available.
|
||||
*/
|
||||
#define VAR_DNSSEC_PROBE "dnssec_probe"
|
||||
#define DEF_DNSSEC_PROBE "ns:."
|
||||
extern char *var_dnssec_probe;
|
||||
|
||||
/* LICENSE
|
||||
/* .ad
|
||||
/* .fi
|
||||
|
||||
@ -20,8 +20,8 @@
|
||||
* Patches change both the patchlevel and the release date. Snapshots have no
|
||||
* patchlevel; they change the release date only.
|
||||
*/
|
||||
#define MAIL_RELEASE_DATE "20201107"
|
||||
#define MAIL_VERSION_NUMBER "3.5.8"
|
||||
#define MAIL_RELEASE_DATE "20210117"
|
||||
#define MAIL_VERSION_NUMBER "3.5.9"
|
||||
|
||||
#ifdef SNAPSHOT
|
||||
#define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE
|
||||
|
||||
@ -330,6 +330,12 @@
|
||||
/* .IP "\fBinfo_log_address_format (external)\fR"
|
||||
/* The email address form that will be used in non-debug logging
|
||||
/* (info, warning, etc.).
|
||||
/* .PP
|
||||
/* Available in Postfix 3.5.9 and later:
|
||||
/* .IP "\fBdnssec_probe (ns:.)\fR"
|
||||
/* The DNS query type (default: "ns") and DNS query name (default:
|
||||
/* ".") that Postfix may use to determine whether DNSSEC validation
|
||||
/* is available.
|
||||
/* MIME PROCESSING CONTROLS
|
||||
/* .ad
|
||||
/* .fi
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user