From 4eb5e53663aa6ffa03f58b1ebad9bd1c3d99b1fc Mon Sep 17 00:00:00 2001 From: Wietse Venema Date: Sat, 13 Jan 2024 00:00:00 -0500 Subject: [PATCH] postfix-3.9-20240113 --- postfix/HISTORY | 7 ++ postfix/RELEASE_NOTES | 49 ++++++++------ postfix/WISHLIST | 3 + postfix/html/postconf.5.html | 105 +++++++++++++++++------------- postfix/html/smtpd.8.html | 6 +- postfix/man/man5/postconf.5 | 105 +++++++++++++++++------------- postfix/man/man8/smtpd.8 | 6 +- postfix/proto/postconf.proto | 105 +++++++++++++++++------------- postfix/proto/stop.double-history | 1 + postfix/src/global/mail_params.h | 2 +- postfix/src/global/mail_version.h | 2 +- postfix/src/smtpd/smtpd.c | 11 ++-- 12 files changed, 230 insertions(+), 172 deletions(-) diff --git a/postfix/HISTORY b/postfix/HISTORY index ac672bcdd..68837521b 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -27715,3 +27715,10 @@ Apologies for any names omitted. Cleanup: updated comments and identifiers because the bare newline handling has evolved. Files: global/smtp_stream.[hc], Files: global/smtp_stream.[hc], smtpd/smtpd.c. + +20240113 + + Cleanup: updated the user interface. The smtpd_forbid_bare_newline + settings are now "require_std_end_of_data", "reject", and + "no", with "yes" as an alias for "require_std_end_of_data". + Files: smtpd/smtpd.c proto/postconf.proto. diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index efcf52cef..a01f8b108 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -45,7 +45,7 @@ stray or characters. This feature applies to all email that Postfix locally or remotely sends out. It is not allowlisted based on client identity. -Major changes with snapshot 20240110 +Major changes with snapshot 20240113 ==================================== This updates Postfix fixes for SMTP smuggling attacks, For background, @@ -56,43 +56,50 @@ This will be back ported to Postfix 3.8.5, 3.7.10, 3.6.14, and 3.5.24. - Improved logging for rejected input (it now includes queue ID, helo, mail, and rcpt, if available). -- The new default setting "smtpd_forbid_bare_newline = normalize" +- The new default "smtpd_forbid_bare_newline = require_std_end_of_data" requires the standard End-of-DATA sequence ., and - allows bare newlines from local and remote SMTP clients, maintaining - more compatibility with infrastructure tools such as probers and - surveys. + allows bare newlines from SMTP clients, maintaining more compatibility + with infrastructure tools such as probers and surveys. - The new setting "smtpd_forbid_bare_newline = reject" requires - the standard End-of-DATA sequence ., and rejects - a command or message that contains a bare newline. To disconnect - the client, specify "smtpd_forbid_bare_newline_reject_code = 521". + that input lines end in , requires the standard + End-of-DATA sequence ., and rejects a command or + message that contains a bare newline. To disconnect the client, + specify "smtpd_forbid_bare_newline_reject_code = 521". -- The old setting "yes" has become an alias for "normalize". +- The old setting "yes" has become an alias for "require_std_end_of_data". - The old setting "no" has not changed, and allows SMTP smuggling. The recommended Postfix 3.9 settings (i.e. the defaults) are now: # Require the standard End-of-DATA sequence .. - # Allow bare newlines from local and remote SMTP clients. + # Otherwise, allow bare and process it as if the client sent + # . # - # This will cause problems for legitimate clients that send a - # non-standard End-of-DATA sequence such as web applications, netcat, - # fax machines, or load balancer health checks. Such clients need - # to be excluded with smtpd_forbid_bare_newline_exclusions. + # Exclude local SMTP clients from enforcement. # - smtpd_forbid_bare_newline = normalize + # This maintains compatibility with many legitimate SMTP client + # applications that send a mix of standard and non-standard line + # endings, but will fail to receive email from client implementations + # that do not send . Such clients need to be + # excluded with smtpd_forbid_bare_newline_exclusions. + # + smtpd_forbid_bare_newline = require_std_end_of_data smtpd_forbid_bare_newline_exclusions = $mynetworks Alternative settings: - # Require the standard End-of-DATA sequence .. - # Reject bare newlines from remote SMTP clients. + # Reject input lines that end in , require that input lines + # end in , and require the standard End-of-DATA sequence + # .. # - # This will cause problems for legitimate clients that send any - # non-standard line endings such as web applications, netcat, fax - # machines, or load balancer health checks. Such clients need to be - # excluded with smtpd_forbid_bare_newline_exclusions. + # Exclude local SMTP clients from enforcement. + # + # This will very likely cause problems for SMTP clients that send + # non-standard line endings such as web applications, netcat, or + # load balancer health checks. Such clients need to be excluded with + # smtpd_forbid_bare_newline_exclusions. # smtpd_forbid_bare_newline = reject smtpd_forbid_bare_newline_exclusions = $mynetworks diff --git a/postfix/WISHLIST b/postfix/WISHLIST index 60e94df1d..df5598fca 100644 --- a/postfix/WISHLIST +++ b/postfix/WISHLIST @@ -6,6 +6,9 @@ Wish list: Disable -DSNAPSHOT and -DNONPROD in makedefs. + Maybe add a pre-release check that stable releases cannot + have -DSNAPSHOT and -DNONPROD. + postfix-install should mention makedefs.out. Remove .printfck directories, and remove printfck targets diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html index 75f304130..aef39eca1 100644 --- a/postfix/html/postconf.5.html +++ b/postfix/html/postconf.5.html @@ -15956,46 +15956,49 @@ This feature is available in Postfix 2.0 and later.
smtpd_forbid_bare_newline -(default: Postfix ≥ 3.9: normalize)
+(default: Postfix ≥ 3.9: require_std_end_of_data)
-

Reject or normalize commands and email message content when an -SMTP client sends lines ending in <LF>. Such line endings are -commonly allowed with UNIX-based SMTP servers, but they violate the -RFC 5321 requirement that lines must end in <CR><LF>. -

+

Reject or restrict input lines from an SMTP client that end in +<LF> instead of the standard <CR><LF>. Such line +endings are commonly allowed with UNIX-based SMTP servers, but they +violate RFC 5321, and allowing such line endings can make a server +vulnerable to +SMTP smuggling.

Specify one of the following values (case does not matter):

-
normalize (default)
Require the standard -End-of-DATA sequence <CR><LF>.<CR><LF>. -Otherwise, maintain compatibility with legacy SMTP clients that -send lines ending in the non-standard <LF>, and treat those -line endings as if the client sent the standard <CR><LF>. -
This may fail to receive email from legitimate SMTP clients -such web applications, netcat, fax machines, or load balancer health -checks. Such clients need to be excluded with -smtpd_forbid_bare_newline_exclusions.
+
require_std_end_of_data (default)
Require the +standard End-of-DATA sequence <CR><LF>.<CR><LF>. +Otherwise, allow input lines ending in the non-standard <LF>, +and process those as if the client sent inputs with the standard +<CR><LF>.
This maintains compatibility with many +legitimate SMTP client applications that send a mix of standard and +non-standard line endings, but will fail to receive email from +client implementations that do not send +<CR><LF>.<CR><LF>. Such clients need to be +excluded with smtpd_forbid_bare_newline_exclusions.
-
yes
Alias for "normalize".
+
yes
Compatibility alias for +require_std_end_of_data.
-
reject
Require the standard End-of-DATA -sequence <CR><LF>.<CR><LF>. When an SMTP -client sends a command or message content line ending in <LF>, -log a "bare <LF> received" error, and reject the command or -message content with $smtpd_forbid_bare_newline_reject_code.
-This will fail to receive email from legitimate SMTP clients that -send non-standard line endings such web applications, netcat, fax -machines, or load balancer health checks. Such clients need to be -excluded with smtpd_forbid_bare_newline_exclusions.
+
reject
Reject a command or message content +when a line ends in <LF>, log a "bare <LF> received" +error, and reject the command or message content with +$smtpd_forbid_bare_newline_reject_code. Require that input +lines end in <CR><LF>, and require the standard End-of-DATA +sequence <CR><LF>.<CR><LF>.
This will +very likely cause problems for SMTP clients that send non-standard +line endings such as web applications, netcat, or load balancer +health checks. Such clients need to be excluded with +smtpd_forbid_bare_newline_exclusions.
-
no
Treat all lines ending in <LF> -as if the client sent <CR><LF>. This option is fully -backwards compatible, but is not recommended for an Internet-facing -SMTP server, because it is vulnerable to SMTP smuggling. -
+
no
Treat a bare <LF> as if the client +sent <CR><LF>. This option is fully backwards compatible, +but is not recommended for an Internet-facing SMTP server, because +it is vulnerable to +SMTP smuggling.
@@ -16004,37 +16007,45 @@ href="https://www.postfix.org/smtp-smuggling.html"> SMTP smuggling. 
 # Require the standard End-of-DATA sequence <CR><LF>.<CR><LF>.
-# Allow bare newlines from local and remote SMTP clients.
+# Otherwise, allow bare <LF> and process it as if the client sent
+# <CR><LF>.
 #
-# This will cause problems for legitimate clients that send a
-# non-standard End-of-DATA sequence such as web applications, netcat,
-# fax machines, or load balancer health checks. Such clients need
-# to be excluded with smtpd_forbid_bare_newline_exclusions.
+# Exclude local SMTP clients from enforcement.
 #
-smtpd_forbid_bare_newline = normalize
+# This maintains compatibility with many legitimate SMTP client
+# applications that send a mix of standard and non-standard line
+# endings, but will fail to receive email from client implementations
+# that do not send <CR><LF>.<CR><LF>. Such clients need to be
+# excluded with smtpd_forbid_bare_newline_exclusions.
+#
+smtpd_forbid_bare_newline = require_std_end_of_data
 smtpd_forbid_bare_newline_exclusions = $mynetworks
 
-# Require the standard End-of-DATA sequence <CR><LF>.<CR><LF>.
-# Reject bare newlines from remote SMTP clients.
+# Reject input lines that end in <LF>, require that input lines
+# end in <CR><LF>, and require the standard End-of-DATA sequence
+# <CR><LF>.<CR><LF>.
 #
-# This will cause problems for legitimate clients that send any
-# non-standard line endings such as web applications, netcat, fax
-# machines, or load balancer health checks. Such clients need to be
-# excluded with smtpd_forbid_bare_newline_exclusions.
+# Exclude local SMTP clients from enforcement.
+#
+# This will very likely cause problems for SMTP clients that send
+# non-standard line endings such as web applications, netcat, or
+# load balancer health checks. Such clients need to be excluded with
+# smtpd_forbid_bare_newline_exclusions.
 #
 smtpd_forbid_bare_newline = reject
 smtpd_forbid_bare_newline_exclusions = $mynetworks
-

This feature with settings 'yes' and 'no' is available in Postfix -≥ 3.9, 3.8.4, 3.7.9, 3.6.13, and 3.5.23. The settings 'reject' -and 'normalize' are available with Postfix ≥ 3.9, 3.8.5, 3.7.10, -3.6.14, and 3.5.24.

+

This feature with settings yes and no is available +in Postfix 3.8.4, 3.7.9, 3.6.13, and 3.5.23. Additionally, the +settings reject, and require_std_end_of_data are +available with Postfix ≥ 3.9, 3.8.5, 3.7.10, 3.6.14, and 3.5.24. +

diff --git a/postfix/html/smtpd.8.html b/postfix/html/smtpd.8.html index 433b7d40e..7ae79aff4 100644 --- a/postfix/html/smtpd.8.html +++ b/postfix/html/smtpd.8.html @@ -997,9 +997,9 @@ SMTPD(8) SMTPD(8) Available in Postfix 3.9, 3.8.4, 3.7.9, 3.6.13, 3.5.23 and later: - smtpd_forbid_bare_newline (Postfix >= 3.9: normalize) - Reject or normalize commands and email message content when an - SMTP client sends lines ending in <LF>. + smtpd_forbid_bare_newline (Postfix >= 3.9: require_std_end_of_data) + Reject or restrict input lines from an SMTP client that end in + <LF> instead of the standard <CR><LF>. smtpd_forbid_bare_newline_exclusions ($mynetworks) Exclude the specified clients from smtpd_forbid_bare_newline diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5 index b565beaee..0c2bbf24d 100644 --- a/postfix/man/man5/postconf.5 +++ b/postfix/man/man5/postconf.5 @@ -11029,45 +11029,53 @@ The smtpd_expansion_filter value is not subject to Postfix configuration parameter $name expansion. .PP This feature is available in Postfix 2.0 and later. -.SH smtpd_forbid_bare_newline (default: Postfix >= 3.9: normalize) -Reject or normalize commands and email message content when an -SMTP client sends lines ending in . Such line endings are -commonly allowed with UNIX\-based SMTP servers, but they violate the -RFC 5321 requirement that lines must end in . +.SH smtpd_forbid_bare_newline (default: Postfix >= 3.9: require_std_end_of_data) +Reject or restrict input lines from an SMTP client that end in + instead of the standard . Such line +endings are commonly allowed with UNIX\-based SMTP servers, but they +violate RFC 5321, and allowing such line endings can make a server +vulnerable to +SMTP smuggling. .PP Specify one of the following values (case does not matter): -.IP "\fBnormalize\fR (default)" -Require the standard -End\-of\-DATA sequence .. -Otherwise, maintain compatibility with legacy SMTP clients that -send lines ending in the non\-standard , and treat those -line endings as if the client sent the standard . +.IP "\fBrequire_std_end_of_data\fR (default)" +Require the +standard End\-of\-DATA sequence .. +Otherwise, allow input lines ending in the non\-standard , +and process those as if the client sent inputs with the standard +. .br -This may fail to receive email from legitimate SMTP clients -such web applications, netcat, fax machines, or load balancer health -checks. Such clients need to be excluded with -smtpd_forbid_bare_newline_exclusions. +This maintains compatibility with many +legitimate SMTP client applications that send a mix of standard and +non\-standard line endings, but will fail to receive email from +client implementations that do not send +.. Such clients need to be +excluded with \fBsmtpd_forbid_bare_newline_exclusions\fR. .br .IP "\fByes\fR" -Alias for "normalize". +Compatibility alias for +\fBrequire_std_end_of_data\fR. .br .IP "\fBreject\fR" -Require the standard End\-of\-DATA -sequence .. When an SMTP -client sends a command or message content line ending in , -log a "bare received" error, and reject the command or -message content with $smtpd_forbid_bare_newline_reject_code. +Reject a command or message content +when a line ends in , log a "bare received" +error, and reject the command or message content with +$\fBsmtpd_forbid_bare_newline_reject_code\fR. Require that input +lines end in , and require the standard End\-of\-DATA +sequence .. .br -This will fail to receive email from legitimate SMTP clients that -send non\-standard line endings such web applications, netcat, fax -machines, or load balancer health checks. Such clients need to be -excluded with smtpd_forbid_bare_newline_exclusions. +This will +very likely cause problems for SMTP clients that send non\-standard +line endings such as web applications, netcat, or load balancer +health checks. Such clients need to be excluded with +\fBsmtpd_forbid_bare_newline_exclusions\fR. .br .IP "\fBno\fR" -Treat all lines ending in -as if the client sent . This option is fully -backwards compatible, but is not recommended for an Internet\-facing -SMTP server, because it is vulnerable to SMTP smuggling. +Treat a bare as if the client +sent . This option is fully backwards compatible, +but is not recommended for an Internet\-facing SMTP server, because +it is vulnerable to +SMTP smuggling. .br .br .PP @@ -11078,14 +11086,18 @@ Examples: .na .ft C # Require the standard End\-of\-DATA sequence .. -# Allow bare newlines from local and remote SMTP clients. +# Otherwise, allow bare and process it as if the client sent +# . # -# This will cause problems for legitimate clients that send a -# non\-standard End\-of\-DATA sequence such as web applications, netcat, -# fax machines, or load balancer health checks. Such clients need -# to be excluded with smtpd_forbid_bare_newline_exclusions. +# Exclude local SMTP clients from enforcement. # -smtpd_forbid_bare_newline = normalize +# This maintains compatibility with many legitimate SMTP client +# applications that send a mix of standard and non\-standard line +# endings, but will fail to receive email from client implementations +# that do not send .. Such clients need to be +# excluded with smtpd_forbid_bare_newline_exclusions. +# +smtpd_forbid_bare_newline = require_std_end_of_data smtpd_forbid_bare_newline_exclusions = $mynetworks .fi .ad @@ -11096,13 +11108,16 @@ smtpd_forbid_bare_newline_exclusions = $mynetworks .nf .na .ft C -# Require the standard End\-of\-DATA sequence .. -# Reject bare newlines from remote SMTP clients. +# Reject input lines that end in , require that input lines +# end in , and require the standard End\-of\-DATA sequence +# .. # -# This will cause problems for legitimate clients that send any -# non\-standard line endings such as web applications, netcat, fax -# machines, or load balancer health checks. Such clients need to be -# excluded with smtpd_forbid_bare_newline_exclusions. +# Exclude local SMTP clients from enforcement. +# +# This will very likely cause problems for SMTP clients that send +# non\-standard line endings such as web applications, netcat, or +# load balancer health checks. Such clients need to be excluded with +# smtpd_forbid_bare_newline_exclusions. # smtpd_forbid_bare_newline = reject smtpd_forbid_bare_newline_exclusions = $mynetworks @@ -11111,10 +11126,10 @@ smtpd_forbid_bare_newline_exclusions = $mynetworks .ft R .in -4 .PP -This feature with settings 'yes' and 'no' is available in Postfix ->= 3.9, 3.8.4, 3.7.9, 3.6.13, and 3.5.23. The settings 'reject' -and 'normalize' are available with Postfix >= 3.9, 3.8.5, 3.7.10, -3.6.14, and 3.5.24. +This feature with settings \fByes\fR and \fBno\fR is available +in Postfix 3.8.4, 3.7.9, 3.6.13, and 3.5.23. Additionally, the +settings \fBreject\fR, and \fBrequire_std_end_of_data\fR are +available with Postfix >= 3.9, 3.8.5, 3.7.10, 3.6.14, and 3.5.24. .SH smtpd_forbid_bare_newline_exclusions (default: $mynetworks) Exclude the specified clients from smtpd_forbid_bare_newline enforcement. It uses the same syntax and parent\-domain matching diff --git a/postfix/man/man8/smtpd.8 b/postfix/man/man8/smtpd.8 index 750dea9cc..a4d41939d 100644 --- a/postfix/man/man8/smtpd.8 +++ b/postfix/man/man8/smtpd.8 @@ -870,9 +870,9 @@ Disconnect remote SMTP clients that violate RFC 2920 (or 5321) command pipelining constraints. .PP Available in Postfix 3.9, 3.8.4, 3.7.9, 3.6.13, 3.5.23 and later: -.IP "\fBsmtpd_forbid_bare_newline (Postfix >= 3.9: normalize)\fR" -Reject or normalize commands and email message content when an -SMTP client sends lines ending in . +.IP "\fBsmtpd_forbid_bare_newline (Postfix >= 3.9: require_std_end_of_data)\fR" +Reject or restrict input lines from an SMTP client that end in + instead of the standard . .IP "\fBsmtpd_forbid_bare_newline_exclusions ($mynetworks)\fR" Exclude the specified clients from smtpd_forbid_bare_newline enforcement. diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto index 8aba13e4a..7e3cd8cee 100644 --- a/postfix/proto/postconf.proto +++ b/postfix/proto/postconf.proto @@ -19055,46 +19055,49 @@ MinProtocol = TLSv1

This feature is available in Postfix ≥ 3.9, 3.8.1, 3.7.6, 3.6.10, and 3.5.20.

-%PARAM smtpd_forbid_bare_newline Postfix ≥ 3.9: normalize +%PARAM smtpd_forbid_bare_newline Postfix ≥ 3.9: require_std_end_of_data -

Reject or normalize commands and email message content when an -SMTP client sends lines ending in <LF>. Such line endings are -commonly allowed with UNIX-based SMTP servers, but they violate the -RFC 5321 requirement that lines must end in <CR><LF>. -

+

Reject or restrict input lines from an SMTP client that end in +<LF> instead of the standard <CR><LF>. Such line +endings are commonly allowed with UNIX-based SMTP servers, but they +violate RFC 5321, and allowing such line endings can make a server +vulnerable to +SMTP smuggling.

Specify one of the following values (case does not matter):

-
normalize (default)
Require the standard -End-of-DATA sequence <CR><LF>.<CR><LF>. -Otherwise, maintain compatibility with legacy SMTP clients that -send lines ending in the non-standard <LF>, and treat those -line endings as if the client sent the standard <CR><LF>. -
This may fail to receive email from legitimate SMTP clients -such web applications, netcat, fax machines, or load balancer health -checks. Such clients need to be excluded with -smtpd_forbid_bare_newline_exclusions.
+
require_std_end_of_data (default)
Require the +standard End-of-DATA sequence <CR><LF>.<CR><LF>. +Otherwise, allow input lines ending in the non-standard <LF>, +and process those as if the client sent inputs with the standard +<CR><LF>.
This maintains compatibility with many +legitimate SMTP client applications that send a mix of standard and +non-standard line endings, but will fail to receive email from +client implementations that do not send +<CR><LF>.<CR><LF>. Such clients need to be +excluded with smtpd_forbid_bare_newline_exclusions.
-
yes
Alias for "normalize".
+
yes
Compatibility alias for +require_std_end_of_data.
-
reject
Require the standard End-of-DATA -sequence <CR><LF>.<CR><LF>. When an SMTP -client sends a command or message content line ending in <LF>, -log a "bare <LF> received" error, and reject the command or -message content with $smtpd_forbid_bare_newline_reject_code.
-This will fail to receive email from legitimate SMTP clients that -send non-standard line endings such web applications, netcat, fax -machines, or load balancer health checks. Such clients need to be -excluded with smtpd_forbid_bare_newline_exclusions.
+
reject
Reject a command or message content +when a line ends in <LF>, log a "bare <LF> received" +error, and reject the command or message content with +$smtpd_forbid_bare_newline_reject_code. Require that input +lines end in <CR><LF>, and require the standard End-of-DATA +sequence <CR><LF>.<CR><LF>.
This will +very likely cause problems for SMTP clients that send non-standard +line endings such as web applications, netcat, or load balancer +health checks. Such clients need to be excluded with +smtpd_forbid_bare_newline_exclusions.
-
no
Treat all lines ending in <LF> -as if the client sent <CR><LF>. This option is fully -backwards compatible, but is not recommended for an Internet-facing -SMTP server, because it is vulnerable to SMTP smuggling. -
+
no
Treat a bare <LF> as if the client +sent <CR><LF>. This option is fully backwards compatible, +but is not recommended for an Internet-facing SMTP server, because +it is vulnerable to +SMTP smuggling.
@@ -19103,37 +19106,45 @@ href="https://www.postfix.org/smtp-smuggling.html"> SMTP smuggling. 
 # Require the standard End-of-DATA sequence <CR><LF>.<CR><LF>.
-# Allow bare newlines from local and remote SMTP clients.
+# Otherwise, allow bare <LF> and process it as if the client sent
+# <CR><LF>.
 #
-# This will cause problems for legitimate clients that send a
-# non-standard End-of-DATA sequence such as web applications, netcat,
-# fax machines, or load balancer health checks. Such clients need
-# to be excluded with smtpd_forbid_bare_newline_exclusions.
+# Exclude local SMTP clients from enforcement.
 #
-smtpd_forbid_bare_newline = normalize
+# This maintains compatibility with many legitimate SMTP client
+# applications that send a mix of standard and non-standard line
+# endings, but will fail to receive email from client implementations
+# that do not send <CR><LF>.<CR><LF>. Such clients need to be
+# excluded with smtpd_forbid_bare_newline_exclusions.
+#
+smtpd_forbid_bare_newline = require_std_end_of_data
 smtpd_forbid_bare_newline_exclusions = $mynetworks
 
-# Require the standard End-of-DATA sequence <CR><LF>.<CR><LF>.
-# Reject bare newlines from remote SMTP clients.
+# Reject input lines that end in <LF>, require that input lines
+# end in <CR><LF>, and require the standard End-of-DATA sequence
+# <CR><LF>.<CR><LF>.
 #
-# This will cause problems for legitimate clients that send any
-# non-standard line endings such as web applications, netcat, fax
-# machines, or load balancer health checks. Such clients need to be
-# excluded with smtpd_forbid_bare_newline_exclusions.
+# Exclude local SMTP clients from enforcement.
+#
+# This will very likely cause problems for SMTP clients that send
+# non-standard line endings such as web applications, netcat, or
+# load balancer health checks. Such clients need to be excluded with
+# smtpd_forbid_bare_newline_exclusions.
 #
 smtpd_forbid_bare_newline = reject
 smtpd_forbid_bare_newline_exclusions = $mynetworks
-

This feature with settings 'yes' and 'no' is available in Postfix -≥ 3.9, 3.8.4, 3.7.9, 3.6.13, and 3.5.23. The settings 'reject' -and 'normalize' are available with Postfix ≥ 3.9, 3.8.5, 3.7.10, -3.6.14, and 3.5.24.

+

This feature with settings yes and no is available +in Postfix 3.8.4, 3.7.9, 3.6.13, and 3.5.23. Additionally, the +settings reject, and require_std_end_of_data are +available with Postfix ≥ 3.9, 3.8.5, 3.7.10, 3.6.14, and 3.5.24. +

%PARAM smtpd_forbid_bare_newline_exclusions $mynetworks diff --git a/postfix/proto/stop.double-history b/postfix/proto/stop.double-history index 98da7a098..d4a1183da 100644 --- a/postfix/proto/stop.double-history +++ b/postfix/proto/stop.double-history @@ -96,3 +96,4 @@ proto proto aliases proto virtual proto ADDRESS_REWRITING_README html Files smtpd smtpd c proto postconf proto RELEASE_NOTES stable releases Files global smtp_stream hc smtpd smtpd c Files global smtp_stream hc smtpd smtpd c + Files smtpd smtpd c proto postconf proto diff --git a/postfix/src/global/mail_params.h b/postfix/src/global/mail_params.h index 1f03b0b34..62d6fb5b8 100644 --- a/postfix/src/global/mail_params.h +++ b/postfix/src/global/mail_params.h @@ -4306,7 +4306,7 @@ extern char *var_smtpd_dns_re_filter; * Backwards compatibility. */ #define VAR_SMTPD_FORBID_BARE_LF "smtpd_forbid_bare_newline" -#define DEF_SMTPD_FORBID_BARE_LF "normalize" +#define DEF_SMTPD_FORBID_BARE_LF "require_std_end_of_data" #define VAR_SMTPD_FORBID_BARE_LF_EXCL "smtpd_forbid_bare_newline_exclusions" #define DEF_SMTPD_FORBID_BARE_LF_EXCL "$" VAR_MYNETWORKS diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h index fcfea29e6..8b6685d77 100644 --- a/postfix/src/global/mail_version.h +++ b/postfix/src/global/mail_version.h @@ -20,7 +20,7 @@ * Patches change both the patchlevel and the release date. Snapshots have no * patchlevel; they change the release date only. */ -#define MAIL_RELEASE_DATE "20240112" +#define MAIL_RELEASE_DATE "20240113" #define MAIL_VERSION_NUMBER "3.9" #ifdef SNAPSHOT diff --git a/postfix/src/smtpd/smtpd.c b/postfix/src/smtpd/smtpd.c index 9cc8c0c81..3a4ff4dfb 100644 --- a/postfix/src/smtpd/smtpd.c +++ b/postfix/src/smtpd/smtpd.c @@ -824,9 +824,9 @@ /* command pipelining constraints. /* .PP /* Available in Postfix 3.9, 3.8.4, 3.7.9, 3.6.13, 3.5.23 and later: -/* .IP "\fBsmtpd_forbid_bare_newline (Postfix >= 3.9: normalize)\fR" -/* Reject or normalize commands and email message content when an -/* SMTP client sends lines ending in . +/* .IP "\fBsmtpd_forbid_bare_newline (Postfix >= 3.9: require_std_end_of_data)\fR" +/* Reject or restrict input lines from an SMTP client that end in +/* instead of the standard . /* .IP "\fBsmtpd_forbid_bare_newline_exclusions ($mynetworks)\fR" /* Exclude the specified clients from smtpd_forbid_bare_newline /* enforcement. @@ -1677,7 +1677,10 @@ int smtpd_hfrom_format; #define IS_BARE_LF_REPLY_REJECT(m) ((m) & BARE_LF_FLAG_REPLY_REJECT) static const NAME_CODE bare_lf_mask_table[] = { - "normalize", BARE_LF_FLAG_WANT_STD_EOD, /* The new default */ + "require_std_end_of_data", BARE_LF_FLAG_WANT_STD_EOD, /* Default */ +#ifdef SNAPSHOT + "normalize", BARE_LF_FLAG_WANT_STD_EOD, /* Migration aid */ +#endif "yes", BARE_LF_FLAG_WANT_STD_EOD, /* Migration aid */ "reject", BARE_LF_FLAG_WANT_STD_EOD | BARE_LF_FLAG_REPLY_REJECT, "no", 0,