diff --git a/postfix/HISTORY b/postfix/HISTORY index a92edce61..133488489 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -28394,3 +28394,48 @@ Apologies for any names omitted. util/stream_recv_fd.c, util/stream_test.c, util/unix_dgram_connect.c, util/unix_dgram_listen.c, util/vbuf.c. + +20241015 + + Documentation: updated the TLSRPT_README text and example + for section "Delivering TLSRPT summaries via email". File: + proto/TLSRPT_README.html. + +20241021 + + Bugfix (defect introduced: postfix 3.0): the default master.cf + syslog_name setting for the relay service did not preserve + multi-instance information. File: conf/master.cf. + +20241022 + + Documentation: updated the TLSRPT_README examples for + MTA-STS. File: proto/TLSRPT_README.html. + + Documentation: add explicit guidance to use "postconf -x" + when checking an inline pcre or regexp table for unescaped + '$' characters. Files: mantools/postlink, proto/pcre_table, + proto/regexp_table. + + Documentation: be explicit about when Postfix expands $name + in inline pcre, regexp, and cidr lookup tables. Files: + proto/cidr_table, proto/pcre_table, proto/regexp_table. + + Safety: replace ASCII control characters that match isspace() + with space characters. This prevents line breaks etc. in + smtp_tls_policy attribute values that use the long form "{ + name = value }". This form was introduced with Postfix 3.10 + TLSRPT support. Files: smtp/smtp_tls_policy.c, util/extpar.c, + util/Makefile.in, util/normalize_ws.c, util/stringops.h. + +20241023 + + Logging: Postfix SMTP server 'reject' logging now shows the + sasl_method, sasl_username, and sasl_sender if available. + Viktor Dukhovni. Files: smtpd/smtpd_check.c. + +20241024 + + Documentation: in a pgsql: client configuration, the setting + "dbname" is required, but ignored when the setting "hosts" + contains an URI with a database name. File: proto/pgsql_table. diff --git a/postfix/README_FILES/TLSRPT_README b/postfix/README_FILES/TLSRPT_README index 9b797d2a7..c84309897 100644 --- a/postfix/README_FILES/TLSRPT_README +++ b/postfix/README_FILES/TLSRPT_README @@ -175,37 +175,39 @@ Notes: DDeelliivveerriinngg TTLLSSRRPPTT ssuummmmaarriieess vviiaa eemmaaiill -RFC 8460 suggests not to enforce strict TLS security when sending daily -success/failure summaries via email, to avoid delivery delays caused by a -failure to enforce TLS security. Postfix currently does not have a mechanism to -disable TLS security enforcement when submitting an email message; this section -provides a workaround. +RFC 8460 Section 3 specifies that an MTA must not enforce TLS security when +sending failure reports via email. However, Postfix currently has no way to +request that TLS enforcement will be disabled when submitting an email message. -By design, TLSRPT is not a real-time notification system; it takes on average -12 hours before a failure is reported in a daily success/failure summary. If a -TLS-related delay of a day or more is undesirable, one could set up a transport -map to make TLS security optional for specific TLSRPT email notification email -addresses. +Options: + + * Do nothing. When TLS security enforcement is required, a persistent + enforcement failure will delay the delivery of a TLSRPT summary until the + problem is addressed, or until the message expires in the mail queue. Keep + in mind that TLSRPT is not a real-time monitoring service; it takes on + average 12 hours before a failure is reported through TLSRPT. + + * Exclude the sender of TLSRPT summaries from TLS enforcement. Implement the + configuration below on outbound MTA instances (replace noreply-smtp-tls- + reporting@example.com with your actual report generator's sender address): /etc/postfix/main.cf: - transport_maps = hash:/etc/postfix/transport - - /etc/postfix/transport: - smtp-tls-report@example.com allow-plaintext: - ... + # Limitation: this setting is overruled with transport_maps. + sender_dependent_default_transport_maps = inline:{ + { noreply-smtp-tls-reporting@example.com = allow-plaintext } } /etc/postfix/master.cf: # service name type private unpriv chroot wakeup maxproc command allow-plaintext unix - - n - - smtp - -o smtp_tls_security_level=may - -o smtp_tls_policy_maps=static:may + -o { smtp_tls_security_level = may } + -o { smtp_tls_policy_maps = static:may } MMTTAA--SSTTSS SSuuppppoorrtt vviiaa ssmmttpp__ttllss__ppoolliiccyy__mmaappss -Postfix supports MTA-STS though an smtp_tls_policy_maps policy plugin. Postfix -3.10 and later expect a policy response with the usual security level and -matching requirements, plus any applicable name=value attributes described +Postfix supports MTA-STS though an smtp_tls_policy_maps policy plugin, which +replies with a TLS security level and optional matching requirements. Postfix +3.10 and later optionally also accept the name=value attributes described below. Specify { name = value } when a value may contain whitespace. Note 1: Postfix 3.10 and later will accept these attributes in an MTA-STS @@ -215,8 +217,17 @@ below. Specify { name = value } when a value may contain whitespace. Note 2: It is an error to specify these attributes for a non-STS policy. -The examples in the table apply to the MTA-STS policy example given in https:// -datatracker.ietf.org/doc/html/rfc8460#section-4.5. +The examples in the table apply to the MTA-STS policy example given in RFC 8461 +Section 3.2: + + version: STSv1 + mode: enforce + mx: mail.example.com + mx: *.example.net + mx: backupmx.example.com + max_age: 604800 + +A policy response may contain line breaks. * policy_type=type @@ -238,7 +249,7 @@ datatracker.ietf.org/doc/html/rfc8460#section-4.5. Example: - { policy_string = version: STSv1 } { policy_string = mode: testing } + { policy_string = version: STSv1 } { policy_string = mode: enforce } ... This form ignores whitespace after the opening "{", around the "=", and @@ -251,7 +262,7 @@ datatracker.ietf.org/doc/html/rfc8460#section-4.5. Example: - mx_host_pattern=mx1.example.com mx_host_pattern=mx2.example.com ... + mx_host_pattern=mail.example.com mx_host_pattern=*.example.net ... * policy_failure=type diff --git a/postfix/WISHLIST b/postfix/WISHLIST index 506cb7c3e..c84db73bb 100644 --- a/postfix/WISHLIST +++ b/postfix/WISHLIST @@ -6,6 +6,19 @@ Wish list: Disable -DSNAPSHOT and -DNONPROD in makedefs. + Add a mail_version chek to each pluggable database client. + + Add an option for a built-in JSON generator. This would + simplify TLSRPT adoption by eliminating a build-time and + run-time dependency on the libtlsrpt client library. Prior + art: this approach was previously used to implement Postfix + Milter support. + + Make TLSRPT support pluggable (postfix-tlsrpt.so, like + postfix-ldap.so, postfix-mysql.so and so on). This avods a + hard install-time dependency on sys4 libtlsrpt. The sys4 + code would still be a build-time dependency. + Add smtp_tlsrpt_allow_list feature (default: static:all) to limit the domains for which Postfix generates TLSRPT daily summaries. @@ -13,6 +26,8 @@ Wish list: Add unit tests for smtp_tlsrpt.c, tlstrpd_wrapper.c, ... + Add unit test for extpar.c + Add tests for Message-ID extraction in the cleanup daemon. When debug logging is enabled, dict_db_open() logs a newline diff --git a/postfix/conf/master.cf b/postfix/conf/master.cf index e5e14e449..17b7551af 100644 --- a/postfix/conf/master.cf +++ b/postfix/conf/master.cf @@ -69,7 +69,7 @@ proxymap unix - - n - - proxymap proxywrite unix - - n - 1 proxymap smtp unix - - n - - smtp relay unix - - n - - smtp - -o syslog_name=postfix/$service_name + -o syslog_name=${multi_instance_name?{$multi_instance_name}:{postfix}}/$service_name # -o smtp_helo_timeout=5 -o smtp_connect_timeout=5 showq unix n - n - - showq error unix - - n - - error diff --git a/postfix/html/TLSRPT_README.html b/postfix/html/TLSRPT_README.html index 6edf95d50..a1fc10f24 100644 --- a/postfix/html/TLSRPT_README.html +++ b/postfix/html/TLSRPT_README.html @@ -266,44 +266,51 @@ have the details for why TLS authentication failed.

Delivering TLSRPT summaries via email

-

RFC 8460 suggests not to enforce strict TLS security when sending -daily success/failure summaries via email, to avoid delivery delays -caused by a failure to enforce TLS security. Postfix currently does -not have a mechanism to disable TLS security enforcement when -submitting an email message; this section provides a workaround.

+

RFC +8460 Section 3 specifies that an MTA must not enforce TLS +security when sending failure reports via email. However, Postfix +currently has no way to request that TLS enforcement will be disabled +when submitting an email message.

-

By design, TLSRPT is not a real-time notification system; it -takes on average 12 hours before a failure is reported in a daily -success/failure summary. If a TLS-related delay of a day or more -is undesirable, one could set up a transport map to make TLS security -optional for specific TLSRPT email notification email addresses. -

+

Options: + +

MTA-STS Support via smtp_tls_policy_maps

-

Postfix supports MTA-STS though an smtp_tls_policy_maps -policy plugin. Postfix 3.10 and later expect a policy response with -the usual security level and matching requirements, plus any -applicable name=value attributes described below. Specify { -name = value } when a value may contain whitespace.

+

Postfix supports MTA-STS though an smtp_tls_policy_maps policy +plugin, which replies with a TLS security level and optional matching +requirements. Postfix 3.10 and later optionally also accept the +name=value attributes described below. Specify { name = value +} when a value may contain whitespace.

@@ -319,8 +326,22 @@ policy.

The examples in the table apply to the MTA-STS policy example -given in https://datatracker.ietf.org/doc/html/rfc8460#section-4.5. -

+given in +RFC 8461 Section 3.2:

+ +
+
+version: STSv1
+mode: enforce
+mx: mail.example.com
+mx: *.example.net
+mx: backupmx.example.com
+max_age: 604800
+
+
+ +

A policy response may contain line breaks.