By default, Postfix SMTPUTF8 support is disabled. Thus, Postfix -should work exactly as it has worked before SMTPUTF8 support was -implemented.
-Before turning on SMTPUTF8 support in Postfix, you need to verify that the rest of your email infrastructure can handle UTF-8 email addresses and message header values, including SMTPUTF8 @@ -65,8 +61,8 @@ parameter in main.cf:
@@ -83,7 +79,7 @@ EHLO response.-# postconf "smtputf8_enable = yes" -# postfix reload +# postconf "smtputf8_enable = yes" +# postfix reload
220 server.example.com ESMTP Postfix -EHLO client.example.com +EHLO client.example.com 250-server.example.com 250-PIPELINING 250-SIZE 10240000 @@ -101,23 +97,23 @@ EHLO client.example.com MAIL FROM and VRFY commands.-MAIL FROM:<address> SMTPUTF8 ... +MAIL FROM:<address> SMTPUTF8 ... -VRFY address SMTPUTF8 +VRFY address SMTPUTF8
The Postfix SMTP client may issue the SMTPUTF8 request in MAIL FROM commands.
-Postfix already permitted UTF-8 in message header values -and in address localparts. This does not change.
-The Postfix SMTP server accepts UTF-8 in email address domains, but only after the remote SMTP client client issues the SMTPUTF8 request in MAIL FROM or VRFY commands.
+Postfix already permitted UTF-8 in message header values +and in address localparts. This does not change.
+After Postfix SMTPUTF8 support is turned on, Postfix behavior @@ -223,7 +219,9 @@ delivered it if SMTPUTF8 support was disabled.
"Internationalized" domain names can appear in two forms: the -UTF-8 form, and the ASCII (xn--mumble) form.
+UTF-8 form, and the ASCII (xn--mumble) form. The initial Postfix +SMTPUTF8 implementation performs no automatic conversions on UTF8 +strings beyond what is needed to perform DNS lookups.In pre-SMTPUTF8 environments, email with UTF-8 in address -localparts (and in headers) works just fine because the vast majority +localparts (and in headers) works just fine. The vast majority of email software including Postfix is perfectly capable of handling such email, even if pre-SMTPUTF8 standards do not support this.
@@ -281,7 +279,7 @@ SMTPUTF8, specify:diff --git a/postfix/html/TLS_README.html b/postfix/html/TLS_README.html index 2548b9f57..234f80960 100644 --- a/postfix/html/TLS_README.html +++ b/postfix/html/TLS_README.html @@ -1373,8 +1373,13 @@ for early adopters.-$ make makefiles -DNO_EAI ... +$ make makefiles -DNO_EAI ...
The "example.com" destination uses DANE, but if TLSA records are not present or are unusable, mail is deferred.
-The "example.org" destination uses DANE if possible, but if no TLSA -records are found opportunistic TLS is used.
+The "example.org" destination uses DANE if possible, but +uses opportunistic TLS if no TLSA records are found. The +"fallback" attribute (Postfix ≥ 2.12) overrides the global +main.cf smtp_tls_fallback_level parameter to employ unauthenticated +mandatory encryption if DANE authentication fails, after logging a +warning. See smtp_tls_audit_template for additional control over TLS +security logging.
@@ -1394,26 +1399,16 @@ records are found opportunistic TLS is used. # default_transport = smtp, but some destinations are special: # transport_maps = ${indexed}transport - --
-
transport:
example.com dane
example.org dane
-
-
-
-
tls_policy:
example.com dane-only
-
-
+ # Postfix ≥ 2.12, per-destination smtp_tls_fallback_level override
+ example.org dane fallback=encrypt
--master.cf: dane unix - - n - - smtp -o smtp_dns_support_level=dnssec @@ -2146,7 +2141,10 @@ href="#client_tls_encrypt">encrypt
This feature is available in Postfix 2.3 and later.
+ + +The LMTP-specific version of the smtp_tls_audit_template +configuration parameter. See there for details.
+ +This feature is available in Postfix 2.12 and later.
+ +This feature is available in Postfix 2.3 and later.
+ + +The LMTP-specific version of the smtp_tls_fallback_level +configuration parameter. See there for details.
+ +This feature is available in Postfix 2.12 and later.
+ +This feature is available in Postfix 2.2 and later.
+ + +Optional template for tls audit logging at the completion of each +message data transfer. If empty (the default setting) no TLS audit log +entries are generated.
+ +The following $name expansions are done on smtp_tls_audit_template:
+ +Example:
+ ++/etc/postfix/main.cf: + smtp_tls_audit_template = + tlsaudit: relay=${relay}${auth?, auth=${auth}}${level?, level=${level}}${policy?, policy=${policy}}${protocol?, protocol=${protocol}}${cipher?, cipher=${cipher}} ++ +
This feature is available in Postfix 2.12 and later.
+ +This feature is available in Postfix 2.3 and later.
+ + +Optional fallback levels for authenticated TLS levels. Specify +a white-space or comma-separated list of +policy_level=fallback_level pairs. The policy_level +must require authentication (one of dane, dane-only, fingerprint, +verify, secure). The fallback_level must be "encrypt" or +"may". When an authenticated connection at some desired policy +level cannot be established, delivery will proceed at the correponding +fallback level if possible. A warning will be logged +indicating the fallback reason. You can use smtp_tls_audit_template +to record the TLS security status for each delivery.
+ +The TLS policy table +can be used to specify a destination-specific fallback strategy via the +"fallback" policy attribute. The value of the "fallback" attribute, if +specified, must be "may", "encrypt" or "none". If not "none", this +specifies the fallback level for the destination in question. If the +attribute value is "none", fallback is suppressed for the destination +even if enabled via a global setting of smtp_tls_fallback_level.
+ +Example:
+ +++ ++/etc/postfix/main.cf: + # When authentication fails, log a warning and deliver anyway + # over an unauthenticated TLS connection. + # + smtp_tls_fallback_level = + dane=encrypt, + dane-only=encrypt, + fingerprint=encrypt, + verify=encrypt, + secure=encrypt + indexed = ${default_database_type}:${config_directory}/ + smtp_tls_policy_maps = ${indexed}tls-policy ++
++ ++/etc/postfix/tls-policy: + # No fallback for example.com + example.com secure fallback=none + # For example.net tolerate cleartext fallback + example.net dane fallback=may ++
This feature is available in Postfix 2.12 and later.
+ +By default, Postfix SMTPUTF8 support is disabled. Thus, Postfix -should work exactly as it has worked before SMTPUTF8 support was -implemented.
-Before turning on SMTPUTF8 support in Postfix, you need to verify that the rest of your email infrastructure can handle UTF-8 email addresses and message header values, including SMTPUTF8 @@ -65,8 +61,8 @@ parameter in main.cf:
@@ -83,7 +79,7 @@ EHLO response.-# postconf "smtputf8_enable = yes" -# postfix reload +# postconf "smtputf8_enable = yes" +# postfix reload
220 server.example.com ESMTP Postfix -EHLO client.example.com +EHLO client.example.com 250-server.example.com 250-PIPELINING 250-SIZE 10240000 @@ -101,23 +97,23 @@ EHLO client.example.com MAIL FROM and VRFY commands.-MAIL FROM:<address> SMTPUTF8 ... +MAIL FROM:<address> SMTPUTF8 ... -VRFY address SMTPUTF8 +VRFY address SMTPUTF8
The Postfix SMTP client may issue the SMTPUTF8 request in MAIL FROM commands.
-Postfix already permitted UTF-8 in message header values -and in address localparts. This does not change.
-The Postfix SMTP server accepts UTF-8 in email address domains, but only after the remote SMTP client client issues the SMTPUTF8 request in MAIL FROM or VRFY commands.
+Postfix already permitted UTF-8 in message header values +and in address localparts. This does not change.
+After Postfix SMTPUTF8 support is turned on, Postfix behavior @@ -223,7 +219,9 @@ delivered it if SMTPUTF8 support was disabled.
"Internationalized" domain names can appear in two forms: the -UTF-8 form, and the ASCII (xn--mumble) form.
+UTF-8 form, and the ASCII (xn--mumble) form. The initial Postfix +SMTPUTF8 implementation performs no automatic conversions on UTF8 +strings beyond what is needed to perform DNS lookups.In pre-SMTPUTF8 environments, email with UTF-8 in address -localparts (and in headers) works just fine because the vast majority +localparts (and in headers) works just fine. The vast majority of email software including Postfix is perfectly capable of handling such email, even if pre-SMTPUTF8 standards do not support this.
@@ -281,7 +279,7 @@ SMTPUTF8, specify:diff --git a/postfix/proto/TLS_README.html b/postfix/proto/TLS_README.html index bc492ebd5..431c323be 100644 --- a/postfix/proto/TLS_README.html +++ b/postfix/proto/TLS_README.html @@ -1373,8 +1373,13 @@ for early adopters.-$ make makefiles -DNO_EAI ... +$ make makefiles -DNO_EAI ...
The "example.com" destination uses DANE, but if TLSA records are not present or are unusable, mail is deferred.
-The "example.org" destination uses DANE if possible, but if no TLSA -records are found opportunistic TLS is used.
+The "example.org" destination uses DANE if possible, but +uses opportunistic TLS if no TLSA records are found. The +"fallback" attribute (Postfix ≥ 2.12) overrides the global +main.cf smtp_tls_fallback_level parameter to employ unauthenticated +mandatory encryption if DANE authentication fails, after logging a +warning. See smtp_tls_audit_template for additional control over TLS +security logging.
@@ -1394,26 +1399,16 @@ main.cf: # default_transport = smtp, but some destinations are special: # transport_maps = ${indexed}transport - --
-
transport:
example.com dane
example.org dane
-
-
-
-
tls_policy:
example.com dane-only
-
-
+ # Postfix ≥ 2.12, per-destination smtp_tls_fallback_level override
+ example.org dane fallback=encrypt
--diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto index c26f1a5da..45181dfd7 100644 --- a/postfix/proto/postconf.proto +++ b/postfix/proto/postconf.proto @@ -11019,8 +11019,8 @@ Example: [mail.example.org]:587 secure match=nexthop # Postfix 2.5 and later [thumb.example.org] fingerprint - match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 - match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 + match=EC:3B:2D:B0:5B:B1:FB:6D:20:A3:9D:72:F6:8D:12:35 + match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1master.cf: dane unix - - n - - smtp -o smtp_dns_support_level=dnssec @@ -2146,7 +2141,10 @@ href="#client_tls_encrypt">encrypt. When usable TLSA records are obtained for the remote SMTP server, SSLv2 is automatically disabled (see smtp_tls_mandatory_protocols), and the server certificate must match the TLSA records. RFC 6698 (DANE) TLS authentication -and DNSSEC support is available with Postfix 2.11 and later. +and DNSSEC support is available with Postfix 2.11 and later. +The optional "fallback" attribute provides a per-site override of +the main.cf smtp_tls_fallback_level parameter (Postfix ≥ 2.12). +dane-only Mandatory DANE TLS. The TLS policy for the destination is obtained via TLSA records in @@ -2155,7 +2153,10 @@ connection is made to the server. When usable TLSA records are obtained for the remote SMTP server, SSLv2 is automatically disabled (see smtp_tls_mandatory_protocols), and the server certificate must match the TLSA records. RFC 6698 (DANE) TLS authentication and -DNSSEC support is available with Postfix 2.11 and later. +DNSSEC support is available with Postfix 2.11 and later. +The optional "fallback" attribute provides a per-site override of +the main.cf smtp_tls_fallback_level parameter (Postfix ≥ 2.12). +fingerprint Certificate fingerprint verification. Available with Postfix 2.5 and @@ -2164,13 +2165,15 @@ authorities. The certificate trust chain, expiration date, ... are not checked. Instead, the optional match attribute, or else the main.cf smtp_tls_fingerprint_cert_match parameter, lists the server certificate fingerprints or public key fingerprints -(Postfix 2.9 and later). The -digest algorithm used to calculate fingerprints is selected by the -smtp_tls_fingerprint_digest parameter. Multiple fingerprints can -be combined with a "|" delimiter in a single match attribute, or multiple -match attributes can be employed. The ":" character is not used as a -delimiter as it occurs between each pair of fingerprint (hexadecimal) -digits. +(Postfix 2.9 and later). The digest algorithm used to calculate +fingerprints is selected by the smtp_tls_fingerprint_digest +parameter. Multiple fingerprints can be combined with a "|" delimiter +in a single match attribute, or multiple match attributes can be +employed. The ":" character is not used as a delimiter as it occurs +between each pair of fingerprint (hexadecimal) digits. +The optional "fallback" attribute provides a per-site override of +the main.cf smtp_tls_fallback_level parameter (Postfix ≥ 2.12). +verify Mandatory server certificate verification. Mail is delivered only if the @@ -2181,9 +2184,11 @@ the optional "match" attribute (or the main.cf smtp_tls_verify_cert_match parameter value when no optional "match" attribute is specified). With Postfix ≥ 2.11 the "tafile" attribute optionally modifies trust chain verification in the same manner as the -"smtp_tls_trust_anchor_file" parameter. The "tafile" attribute -may be specified multiple times to load multiple trust-anchor -files. +"smtp_tls_trust_anchor_file" parameter. The "tafile" attribute may +be specified multiple times to load multiple trust-anchor files. +The optional "fallback" attribute provides a per-site override of +the main.cf smtp_tls_fallback_level parameter (Postfix ≥ 2.12). +secure Secure certificate verification. Mail is delivered only if the TLS handshake succeeds, @@ -2195,7 +2200,10 @@ main.cf smtp_tls_secure_cert_match parameter value when no optional attribute optionally modifies trust chain verification in the same manner as the "smtp_tls_trust_anchor_file" parameter. The "tafile" attribute may be specified multiple times to load multiple trust-anchor -files. +files. +The optional "fallback" attribute provides a per-site override of +the main.cf smtp_tls_fallback_level parameter (Postfix ≥ 2.12). + @@ -2242,6 +2250,7 @@ Example: smtp_tls_policy_maps = hash:/etc/postfix/tls_policy # Postfix 2.5 and later smtp_tls_fingerprint_digest = md5 + /etc/postfix/tls_policy: example.edu none example.mil may @@ -2256,6 +2265,8 @@ Example: match=3D:95:34:51:24:66:33:B9:D2:40:99:C0:C1:17:0B:D1 # Postfix 2.6 and later example.info may protocols=!SSLv2 ciphers=medium exclude=3DES + # Postfix 2.12 and later override of smtp_tls_fallback_level + fallback.example secure fallback=encrypt
Note: The hostname strategy if listed in a non-default @@ -16184,3 +16184,133 @@ mail.
This feature is available in Postfix 2.12 and later.
+ +%PARAM smtp_tls_fallback_level + +Optional fallback levels for authenticated TLS levels. Specify +a white-space or comma-separated list of +policy_level=fallback_level pairs. The policy_level +must require authentication (one of dane, dane-only, fingerprint, +verify, secure). The fallback_level must be "encrypt" or +"may". When an authenticated connection at some desired policy +level cannot be established, delivery will proceed at the correponding +fallback level if possible. A warning will be logged +indicating the fallback reason. You can use smtp_tls_audit_template +to record the TLS security status for each delivery.
+ +The TLS policy table +can be used to specify a destination-specific fallback strategy via the +"fallback" policy attribute. The value of the "fallback" attribute, if +specified, must be "may", "encrypt" or "none". If not "none", this +specifies the fallback level for the destination in question. If the +attribute value is "none", fallback is suppressed for the destination +even if enabled via a global setting of smtp_tls_fallback_level.
+ +Example:
+ +
+
+/etc/postfix/main.cf:
+ # When authentication fails, log a warning and deliver anyway
+ # over an unauthenticated TLS connection.
+ #
+ smtp_tls_fallback_level =
+ dane=encrypt,
+ dane-only=encrypt,
+ fingerprint=encrypt,
+ verify=encrypt,
+ secure=encrypt
+ indexed = ${default_database_type}:${config_directory}/
+ smtp_tls_policy_maps = ${indexed}tls-policy
+
+
+
+++ ++/etc/postfix/tls-policy: + # No fallback for example.com + example.com secure fallback=none + # For example.net tolerate cleartext fallback + example.net dane fallback=may ++
This feature is available in Postfix 2.12 and later.
+ +%PARAM lmtp_tls_fallback_level + +The LMTP-specific version of the smtp_tls_fallback_level +configuration parameter. See there for details.
+ +This feature is available in Postfix 2.12 and later.
+ +%PARAM smtp_tls_audit_template + +Optional template for tls audit logging at the completion of each +message data transfer. If empty (the default setting) no TLS audit log +entries are generated.
+ +The following $name expansions are done on smtp_tls_audit_template:
+ +Example:
+ +
+/etc/postfix/main.cf:
+ smtp_tls_audit_template =
+ tlsaudit: relay=${relay}${auth?, auth=${auth}}${level?, level=${level}}${policy?, policy=${policy}}${protocol?, protocol=${protocol}}${cipher?, cipher=${cipher}}
+
+
+This feature is available in Postfix 2.12 and later.
+ +%PARAM lmtp_tls_audit_template + +The LMTP-specific version of the smtp_tls_audit_template +configuration parameter. See there for details.
+ +This feature is available in Postfix 2.12 and later.
diff --git a/postfix/src/global/dict_mysql.c b/postfix/src/global/dict_mysql.c index e899a1489..268f51d33 100644 --- a/postfix/src/global/dict_mysql.c +++ b/postfix/src/global/dict_mysql.c @@ -349,9 +349,11 @@ static const char *dict_mysql_lookup(DICT *dict, const char *name) msg_info("%s: Skipping lookup of '%s'", myname, name); return (0); } - if (domain_rc < 0) + if (domain_rc < 0) { + msg_warn("%s:%s 'domain' pattern match failed for '%s'", + dict->type, dict->name, name); DICT_ERR_VAL_RETURN(dict, domain_rc, (char *) 0); - + } #define INIT_VSTR(buf, len) do { \ if (buf == 0) \ buf = vstring_alloc(len); \ diff --git a/postfix/src/global/mail_params.h b/postfix/src/global/mail_params.h index 3b402a708..494112014 100644 --- a/postfix/src/global/mail_params.h +++ b/postfix/src/global/mail_params.h @@ -1372,6 +1372,12 @@ extern bool var_smtp_tls_enforce_peername; #define DEF_LMTP_TLS_LEVEL "" extern char *var_smtp_tls_level; +#define VAR_SMTP_TLS_FBACK_LEVEL "smtp_tls_fallback_level" +#define DEF_SMTP_TLS_FBACK_LEVEL "" +#define VAR_LMTP_TLS_FBACK_LEVEL "lmtp_tls_fallback_level" +#define DEF_LMTP_TLS_FBACK_LEVEL "" +extern char *var_smtp_tls_fback_level; + #define VAR_SMTP_TLS_SCERT_VD "smtp_tls_scert_verifydepth" #define DEF_SMTP_TLS_SCERT_VD 9 #define VAR_LMTP_TLS_SCERT_VD "lmtp_tls_scert_verifydepth" @@ -1543,6 +1549,12 @@ extern bool var_smtp_tls_blk_early_mail_reply; #define DEF_LMTP_TLS_FORCE_TLSA 0 extern bool var_smtp_tls_force_tlsa; +#define VAR_SMTP_TLS_AUDIT_TEMPLATE "smtp_tls_audit_template" +#define DEF_SMTP_TLS_AUDIT_TEMPLATE "" +#define VAR_LMTP_TLS_AUDIT_TEMPLATE "lmtp_tls_audit_template" +#define DEF_LMTP_TLS_AUDIT_TEMPLATE "" +extern char *var_smtp_tls_audit_template; + /* * SASL authentication support, SMTP server side. */ diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h index c2a8dc360..add3094a4 100644 --- a/postfix/src/global/mail_version.h +++ b/postfix/src/global/mail_version.h @@ -20,7 +20,7 @@ * Patches change both the patchlevel and the release date. Snapshots have no * patchlevel; they change the release date only. */ -#define MAIL_RELEASE_DATE "20140801" +#define MAIL_RELEASE_DATE "20140905" #define MAIL_VERSION_NUMBER "2.12" #ifdef SNAPSHOT diff --git a/postfix/src/smtp/Makefile.in b/postfix/src/smtp/Makefile.in index fdbab2f97..e271bf7d4 100644 --- a/postfix/src/smtp/Makefile.in +++ b/postfix/src/smtp/Makefile.in @@ -2,11 +2,11 @@ SHELL = /bin/sh SRCS = smtp.c smtp_connect.c smtp_proto.c smtp_chat.c smtp_session.c \ smtp_addr.c smtp_trouble.c smtp_state.c smtp_rcpt.c smtp_tls_policy.c \ smtp_sasl_proto.c smtp_sasl_glue.c smtp_reuse.c smtp_map11.c \ - smtp_sasl_auth_cache.c smtp_key.c + smtp_sasl_auth_cache.c smtp_key.c smtp_tls_audit.c OBJS = smtp.o smtp_connect.o smtp_proto.o smtp_chat.o smtp_session.o \ smtp_addr.o smtp_trouble.o smtp_state.o smtp_rcpt.o smtp_tls_policy.o \ smtp_sasl_proto.o smtp_sasl_glue.o smtp_reuse.o smtp_map11.o \ - smtp_sasl_auth_cache.o smtp_key.o + smtp_sasl_auth_cache.o smtp_key.o smtp_tls_audit.o HDRS = smtp.h smtp_sasl.h smtp_addr.h smtp_reuse.h smtp_sasl_auth_cache.h TESTSRC = DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE) @@ -662,6 +662,41 @@ smtp_state.o: ../../include/vstring.h smtp_state.o: smtp.h smtp_state.o: smtp_sasl.h smtp_state.o: smtp_state.c +smtp_tls_audit.o: ../../include/argv.h +smtp_tls_audit.o: ../../include/attr.h +smtp_tls_audit.o: ../../include/deliver_request.h +smtp_tls_audit.o: ../../include/dict.h +smtp_tls_audit.o: ../../include/dns.h +smtp_tls_audit.o: ../../include/dsn.h +smtp_tls_audit.o: ../../include/dsn_buf.h +smtp_tls_audit.o: ../../include/header_body_checks.h +smtp_tls_audit.o: ../../include/header_opts.h +smtp_tls_audit.o: ../../include/htable.h +smtp_tls_audit.o: ../../include/mac_expand.h +smtp_tls_audit.o: ../../include/mac_parse.h +smtp_tls_audit.o: ../../include/mail_params.h +smtp_tls_audit.o: ../../include/maps.h +smtp_tls_audit.o: ../../include/match_list.h +smtp_tls_audit.o: ../../include/mime_state.h +smtp_tls_audit.o: ../../include/msg.h +smtp_tls_audit.o: ../../include/msg_stats.h +smtp_tls_audit.o: ../../include/myaddrinfo.h +smtp_tls_audit.o: ../../include/myflock.h +smtp_tls_audit.o: ../../include/name_code.h +smtp_tls_audit.o: ../../include/name_mask.h +smtp_tls_audit.o: ../../include/recipient_list.h +smtp_tls_audit.o: ../../include/resolve_clnt.h +smtp_tls_audit.o: ../../include/scache.h +smtp_tls_audit.o: ../../include/sock_addr.h +smtp_tls_audit.o: ../../include/string_list.h +smtp_tls_audit.o: ../../include/sys_defs.h +smtp_tls_audit.o: ../../include/tls.h +smtp_tls_audit.o: ../../include/tok822.h +smtp_tls_audit.o: ../../include/vbuf.h +smtp_tls_audit.o: ../../include/vstream.h +smtp_tls_audit.o: ../../include/vstring.h +smtp_tls_audit.o: smtp.h +smtp_tls_audit.o: smtp_tls_audit.c smtp_tls_policy.o: ../../include/argv.h smtp_tls_policy.o: ../../include/attr.h smtp_tls_policy.o: ../../include/ctable.h diff --git a/postfix/src/smtp/lmtp_params.c b/postfix/src/smtp/lmtp_params.c index 1861e5ba5..eb84c920e 100644 --- a/postfix/src/smtp/lmtp_params.c +++ b/postfix/src/smtp/lmtp_params.c @@ -28,6 +28,7 @@ VAR_LMTP_TLS_ECCERT_FILE, DEF_LMTP_TLS_ECCERT_FILE, &var_smtp_tls_eccert_file, 0, 0, VAR_LMTP_TLS_ECKEY_FILE, DEF_LMTP_TLS_ECKEY_FILE, &var_smtp_tls_eckey_file, 0, 0, VAR_LMTP_TLS_LOGLEVEL, DEF_LMTP_TLS_LOGLEVEL, &var_smtp_tls_loglevel, 0, 0, + VAR_LMTP_TLS_FBACK_LEVEL, DEF_LMTP_TLS_FBACK_LEVEL, &var_smtp_tls_fback_level, 0, 0, #endif VAR_LMTP_SASL_MECHS, DEF_LMTP_SASL_MECHS, &var_smtp_sasl_mechs, 0, 0, VAR_LMTP_SASL_TYPE, DEF_LMTP_SASL_TYPE, &var_smtp_sasl_type, 1, 0, @@ -119,3 +120,11 @@ VAR_LMTP_DUMMY_MAIL_AUTH, DEF_LMTP_DUMMY_MAIL_AUTH, &var_smtp_dummy_mail_auth, 0, }; + + /* Suppress $name expansion upon loading. */ + static const CONFIG_RAW_TABLE lmtp_raw_table[] = { +#ifdef USE_TLS + VAR_LMTP_TLS_AUDIT_TEMPLATE, DEF_LMTP_TLS_AUDIT_TEMPLATE, &var_smtp_tls_audit_template, 0, 0, +#endif + 0, + }; diff --git a/postfix/src/smtp/smtp.c b/postfix/src/smtp/smtp.c index 158c273e6..130b251f9 100644 --- a/postfix/src/smtp/smtp.c +++ b/postfix/src/smtp/smtp.c @@ -462,6 +462,13 @@ /* RFC 6698 trust-anchor digest support in the Postfix TLS library. /* .IP "\fBtlsmgr_service_name (tlsmgr)\fR" /* The name of the \fBtlsmgr\fR(8) service entry in master.cf. +/* .PP +/* Available in Postfix version 2.12 and later: +/* .IP "\fBsmtp_tls_audit_template (empty)\fR" +/* Optional template for tls audit logging at the completion of each +/* message data transfer. +/* .IP "\fBsmtp_tls_fallback_level (empty)\fR" +/* Optional fallback levels for authenticated TLS levels. /* OBSOLETE STARTTLS CONTROLS /* .ad /* .fi @@ -581,8 +588,8 @@ /* Enable experimental SMTPUTF8 support for the protocols described /* in RFC 6531..6533. /* .IP "\fBsmtputf8_autodetect_classes (sendmail, verify)\fR" -/* Enable SMTPUTF8 autodetection for the specified mail origin -/* classes. +/* Detect that a message requires SMTPUTF8 support for the specified +/* mail origin classes. /* TROUBLE SHOOTING CONTROLS /* .ad /* .fi @@ -856,6 +863,7 @@ char *var_smtp_tls_mand_excl; char *var_smtp_tls_dcert_file; char *var_smtp_tls_dkey_file; bool var_smtp_tls_enforce_peername; +char *var_smtp_tls_fback_level; char *var_smtp_tls_key_file; char *var_smtp_tls_loglevel; bool var_smtp_tls_note_starttls_offer; @@ -872,6 +880,7 @@ char *var_smtp_tls_eccert_file; char *var_smtp_tls_eckey_file; bool var_smtp_tls_blk_early_mail_reply; bool var_smtp_tls_force_tlsa; +char *var_smtp_tls_audit_template; #endif @@ -1285,6 +1294,8 @@ int main(int argc, char **argv) smtp_int_table : lmtp_int_table, MAIL_SERVER_STR_TABLE, smtp_mode ? smtp_str_table : lmtp_str_table, + MAIL_SERVER_RAW_TABLE, smtp_mode ? + smtp_raw_table : lmtp_raw_table, MAIL_SERVER_BOOL_TABLE, smtp_mode ? smtp_bool_table : lmtp_bool_table, MAIL_SERVER_PRE_INIT, pre_init, diff --git a/postfix/src/smtp/smtp.h b/postfix/src/smtp/smtp.h index c21aa65a5..2e58af635 100644 --- a/postfix/src/smtp/smtp.h +++ b/postfix/src/smtp/smtp.h @@ -92,6 +92,8 @@ typedef struct SMTP_ITERATOR { typedef struct SMTP_TLS_POLICY { int level; /* TLS enforcement level */ + int policy_level; /* TLS desired policy level */ + int fallback_level; /* TLS fallback level */ char *protocols; /* Acceptable SSL protocols */ char *grade; /* Cipher grade: "export", ... */ VSTRING *exclusions; /* Excluded SSL ciphers */ @@ -120,11 +122,13 @@ extern void smtp_tls_policy_cache_flush(void); SMTP_TLS_POLICY *_tls_policy_dummy_tmp = (t); \ smtp_tls_policy_init(_tls_policy_dummy_tmp, (DSN_BUF *) 0); \ _tls_policy_dummy_tmp->level = TLS_LEV_NONE; \ + _tls_policy_dummy_tmp->policy_level = TLS_LEV_NONE; \ } while (0) /* This macro is not part of the module external interface. */ #define smtp_tls_policy_init(t, w) do { \ SMTP_TLS_POLICY *_tls_policy_init_tmp = (t); \ + _tls_policy_init_tmp->fallback_level = TLS_LEV_NOTFOUND; \ _tls_policy_init_tmp->protocols = 0; \ _tls_policy_init_tmp->grade = 0; \ _tls_policy_init_tmp->exclusions = 0; \ @@ -341,6 +345,7 @@ typedef struct SMTP_SESSION { char *tls_nexthop; /* Nexthop domain for cert checks */ int tls_retry_plain; /* Try plain when TLS handshake fails */ SMTP_TLS_POLICY *tls; /* TEMPORARY */ + int tls_level; /* Actual tls level */ #endif SMTP_STATE *state; /* back link */ @@ -469,14 +474,16 @@ extern HBC_CALL_BACKS smtp_hbc_callbacks[]; #define PLAINTEXT_FALLBACK_OK_AFTER_STARTTLS_FAILURE \ (session->tls_context == 0 \ - && session->tls->level == TLS_LEV_MAY \ + && (session->tls->level == TLS_LEV_MAY \ + || session->tls->fallback_level == TLS_LEV_MAY) \ && PREACTIVE_DELAY >= var_min_backoff_time \ && !HAVE_SASL_CREDENTIALS) #define PLAINTEXT_FALLBACK_OK_AFTER_TLS_SESSION_FAILURE \ (session->tls_context != 0 \ && SMTP_RCPT_LEFT(state) > SMTP_RCPT_MARK_COUNT(state) \ - && session->tls->level == TLS_LEV_MAY \ + && (session->tls->level == TLS_LEV_MAY \ + || session->tls->fallback_level == TLS_LEV_MAY) \ && PREACTIVE_DELAY >= var_min_backoff_time \ && !HAVE_SASL_CREDENTIALS) @@ -488,8 +495,17 @@ extern HBC_CALL_BACKS smtp_hbc_callbacks[]; #define RETRY_AS_PLAINTEXT do { \ session->tls_retry_plain = 1; \ state->misc_flags &= ~SMTP_MISC_FLAG_FINAL_SERVER; \ + (void) smtp_tls_trouble(state, session->tls_context ? \ + STARTTLS_SESSION_FALLBACK : \ + STARTTLS_HANDSHAKE_FALLBACK); \ } while (0) +#define STARTTLS_FEATURE_FALLBACK 1 /* No STARTTLS feature */ +#define STARTTLS_COMMAND_FALLBACK 2 /* Refused STARTTLS command */ +#define STARTTLS_HANDSHAKE_FALLBACK 3 /* Handshake failed */ +#define STARTTLS_VERIFY_FALLBACK 4 /* Peer verification failed */ +#define STARTTLS_SESSION_FALLBACK 5 /* Data transfer failed */ + /* * smtp_chat.c */ @@ -572,6 +588,11 @@ extern void PRINTFLIKE(5, 6) smtp_rcpt_fail(SMTP_STATE *, RECIPIENT *, const char *,...); extern int smtp_stream_except(SMTP_STATE *, int, const char *); +#ifdef USE_TLS +extern int smtp_tls_trouble(SMTP_STATE *, int); + +#endif + /* * smtp_unalias.c */ @@ -649,6 +670,11 @@ char *smtp_key_prefix(VSTRING *, const char *, SMTP_ITERATOR *, int); | COND_SASL_SMTP_KEY_FLAG_NEXTHOP | COND_SASL_SMTP_KEY_FLAG_HOSTNAME \ | SMTP_KEY_FLAG_ADDR | SMTP_KEY_FLAG_PORT) + /* + * smtp_tls_audit.c + */ +extern void smtp_tls_audit(const char *, SMTP_SESSION *); + /* * Silly little macros. */ diff --git a/postfix/src/smtp/smtp_connect.c b/postfix/src/smtp/smtp_connect.c index acff1eba4..be55b27e4 100644 --- a/postfix/src/smtp/smtp_connect.c +++ b/postfix/src/smtp/smtp_connect.c @@ -108,6 +108,18 @@ #include