mir/postfix
2
0
Fork 0
mirror of https://github.com/vdukhovni/postfix synced 2025-08-29 21:27:57 +00:00
Code Issues Releases Wiki Activity

postfix-3.6.14

Browse Source
This commit is contained in:
Wietse Venema 2024-01-21 00:00:00 -05:00 committed by Viktor Dukhovni
parent a6596ec37a
commit cb3b1cbda3
22 changed files with 782 additions and 187 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
postfix/HISTORY
View File

@ -26037,16 +26037,36 @@ Apologies for any names omitted.
a configured recipient delimiter value. Reported by Tod a configured recipient delimiter value. Reported by Tod
A. Sandman. Files: proto/postconf.proto, local/local_expand.c. A. Sandman. Files: proto/postconf.proto, local/local_expand.c.
20231221 20240109
Security: with "smtpd_forbid_bare_newline = yes" (default Security (outbound SMTP smuggling): with the default setting
"no" for Postfix < 3.9), reply with "Error: bare <LF> "cleanup_replace_stray_cr_lf = yes" Postfix will replace
received" and disconnect when an SMTP client sends a line stray <CR> or <LF> characters in message content with a
ending in <LF>, violating the RFC 5321 requirement that space character. This prevents Postfix from enabling
lines must end in <CR><LF>. This prevents SMTP smuggling outbound (remote) SMTP smuggling, and it also makes evaluation
attacks that target a recipient at a Postfix server. For of Postfix-added DKIM etc. signatures independent from how
backwards compatibility, local clients are excluded by a remote mail server handles stray <CR> or <LF> characters.
Files: global/mail_params.h, cleanup/cleanup.c,
cleanup/cleanup_message.c, mantools/postlink, proto/postconf.proto.
20240112
Security (inbound SMTP smuggling): with "smtpd_forbid_bare_newline
= normalize" (default "no" for Postfix < 3.9), the Postfix
SMTP server requires the standard End-of-DATA sequence
<CR><LF>.<CR><LF>, and otherwise allows command or message
content lines ending in the non-standard <LF>, processing
them as if the client sent the standard <CR><LF>.
The alternative setting, "smtpd_forbid_bare_newline = reject"
will reject any command or message that contains a bare
<LF>, and is more likely to cause problems with legitimate
clients.
For backwards compatibility, local clients are excluded by
default with "smtpd_forbid_bare_newline_exclusions = default with "smtpd_forbid_bare_newline_exclusions =
$mynetworks". Files: mantools/postlink, proto/postconf.proto, $mynetworks".
Files: mantools/postlink, proto/postconf.proto,
global/mail_params.h, global/smtp_stream.c, global/smtp_stream.h, global/mail_params.h, global/smtp_stream.c, global/smtp_stream.h,
smtpd/smtpd.c. smtpd/smtpd.c, smtpd/smtpd_check.[hc].

107
postfix/RELEASE_NOTES
View File

@ -25,30 +25,103 @@ more recent Eclipse Public License 2.0. Recipients can choose to take
the software under the license of their choice. Those who are more the software under the license of their choice. Those who are more
comfortable with the IPL can continue with that license. comfortable with the IPL can continue with that license.
Major changes with Postfix 3.6.13 Incompatibility with Postfix 3.8.5, 3.7.10, 3.6.14, and 3.5.24
================================= ==============================================================
Security: the Postfix SMTP server optionally disconnects a remote Improvements for outbound SMTP smuggling defense:
SMTP client that sends a 'bare newline' line ending in SMTP. This
prevents an SMTP smuggling attack on recipients at a Postfix server.
For background, see https://www.postfix.org/smtp-smuggling.html
Sites concerned about SMTP smuggling attacks should enable this - With "cleanup_replace_stray_cr_lf = yes" (the default), the cleanup
feature in Internet-facing Postfix servers. For compatibility with daemon replaces each stray <CR> or <LF> character in message
non-standard clients, Postfix by default excludes clients in content with a space character. The replacement happens before
mynetworks from this countermeasure. any other content management (header/body_checks, Milters, etc).
The recommended settings are: This prevents outbound SMTP smuggling, where an attacker uses
Postfix to send email containing a non-standard End-of-DATA
sequence, to exploit inbound SMTP smuggling at a vulnerable remote
SMTP server.
# Optionally disconnect remote SMTP clients that send bare newlines, This also improves the remote evaluation of Postfix-added DKIM
# but allow local clients with non-standard SMTP implementations and other signatures, as the evaluation result will not depend
# such as netcat, fax machines, or load balancer health checks. on how a remote email server handles stray <CR> or <LF> characters.
This feature applies to all email that Postfix locally or remotely
sends out. It is not allowlisted based on client identity.
Major changes with Postfix 3.8.5, 3.7.10, 3.6.14, and 3.5.24
============================================================
Improvements for inbound SMTP smuggling defense:
- Better compatibility: the recommended setting "smtpd_forbid_bare_newline
= normalize" requires the standard End-of-DATA sequence
<CR><LF>.<CR><LF>, but allows bare newlines from SMTP clients,
maintaining more compatibility with existing infrastructure.
- Improved logging for rejected input (it now includes queue ID,
helo, mail, and rcpt, if available).
- The setting "smtpd_forbid_bare_newline = reject" requires
that input lines end in <CR><LF>, requires the standard End-of-DATA
sequence <CR><LF>.<CR><LF>, and rejects a command or message that
contains a bare newline. To disconnect the client, specify
"smtpd_forbid_bare_newline_reject_code = 521".
- The Postfix SMTP server no longer strips extra <CR> as in
<CR><LF>.<CR><CR><LF>, to silence false alarms from test tools
that send attack sequences that real mail servers cannot send.
Details at https://www.postfix.org/false-smuggling-claims.html
- The old setting "yes" has become an alias for "normalize".
- The old setting "no" has not changed, and allows SMTP smuggling.
The recommended settings are now:
# Require the standard End-of-DATA sequence <CR><LF>.<CR><LF>.
# Otherwise, allow bare <LF> and process it as if the client sent
# <CR><LF>.
# #
smtpd_forbid_bare_newline = no # This maintains compatibility with many legitimate SMTP client
# applications that send a mix of standard and non-standard line
# endings, but will fail to receive email from client implementations
# that do not terminate DATA content with the standard End-of-DATA
# sequence <CR><LF>.<CR><LF>.
#
# Such clients can be allowlisted with smtpd_forbid_bare_newline_exclusions.
# The example below allowlists SMTP clients in trusted networks.
#
smtpd_forbid_bare_newline = normalize
smtpd_forbid_bare_newline_exclusions = $mynetworks smtpd_forbid_bare_newline_exclusions = $mynetworks
This feature is back-ported from Postfix 3.9, with the difference Alternative settings:
that "smtpd_forbid_bare_newline = no" by default.
# Reject input lines that contain <LF> and log a "bare <LF> received"
# error. Require that input lines end in <CR><LF>, and require the
# standard End-of-DATA sequence <CR><LF>.<CR><LF>.
#
# This will reject email from SMTP clients that send any non-standard
# line endings such as web applications, netcat, or load balancer
# health checks.
#
# This will also reject email from services that use BDAT to send
# MIME text containing a bare newline (RFC 3030 Section 3 requires
# canonical MIME format for text message types, defined in RFC 2045
# Sections 2.7 and 2.8).
#
# Such clients can be allowlisted with smtpd_forbid_bare_newline_exclusions.
# The example below allowlists SMTP clients in trusted networks.
#
smtpd_forbid_bare_newline = reject
smtpd_forbid_bare_newline_exclusions = $mynetworks
#
# Alternatively, in the case of BDAT violations, BDAT can be selectively
# disabled with smtpd_discard_ehlo_keyword_address_maps, or globally
# disabled with smtpd_discard_ehlo_keywords.
#
# smtpd_discard_ehlo_keyword_address_maps = cidr:/path/to/file
# /path/to/file:
# 10.0.0.0/24 chunking, silent-discard
# smtpd_discard_ehlo_keywords = chunking, silent-discard
Major changes with Postfix 3.6.10 Major changes with Postfix 3.6.10
================================= =================================

10
postfix/html/cleanup.8.html
View File

@ -156,6 +156,16 @@ CLEANUP(8) CLEANUP(8)
The set of characters that Postfix will remove from message con- The set of characters that Postfix will remove from message con-
tent. tent.
Available in Postfix version 3.9, 3.8.5, 3.7.10, 3.6.14, 3.5.24, and
later:
<b><a href="postconf.5.html#cleanup_replace_stray_cr_lf">cleanup_replace_stray_cr_lf</a> (yes)</b>
Replace each stray &lt;CR&gt; or &lt;LF&gt; character in message content
with a space character, to prevent outbound SMTP smuggling, and
to make the evaluation of Postfix-added DKIM or other signatures
independent from how a remote mail server handles such charac-
ters.
<b>BEFORE QUEUE MILTER CONTROLS</b> <b>BEFORE QUEUE MILTER CONTROLS</b>
As of version 2.3, Postfix supports the Sendmail version 8 Milter (mail As of version 2.3, Postfix supports the Sendmail version 8 Milter (mail
filter) protocol. When mail is not received via the <a href="smtpd.8.html">smtpd(8)</a> server, filter) protocol. When mail is not received via the <a href="smtpd.8.html">smtpd(8)</a> server,

184
postfix/html/postconf.5.html
View File

@ -1442,6 +1442,40 @@ Examples:
</pre> </pre>
</DD>
<DT><b><a name="cleanup_replace_stray_cr_lf">cleanup_replace_stray_cr_lf</a>
(default: yes)</b></DT><DD>
<p> Replace each stray &lt;CR&gt; or &lt;LF&gt; character in message
content with a space character, to prevent outbound SMTP smuggling,
and to make the evaluation of Postfix-added DKIM or other signatures
independent from how a remote mail server handles such characters.
</p>
<p> SMTP does not allow such characters unless they are part of a
&lt;CR&gt;&lt;LF&gt; sequence, and different mail systems handle
such stray characters in an implementation-dependent manner. Stray
&lt;CR&gt; or &lt;LF&gt; characters could be used for outbound
SMTP smuggling, where an attacker uses a Postfix server to send
message content with a non-standard End-of-DATA sequence that
triggers inbound SMTP smuggling at a remote SMTP server.</p>
<p> The replacement happens before all other content management,
and before Postfix may add a DKIM etc. signature; if the signature
were created first, the replacement could invalidate the signature.
</p>
<p> In addition to preventing SMTP smuggling, replacing stray
&lt;CR&gt; or &lt;LF&gt; characters ensures that the result of
signature validation by later mail system will not depend on how
that mail system handles those stray characters in an
implementation-dependent manner. </p>
<p> This feature is available in Postfix &ge; 3.9, 3.8.5, 3.7.10,
3.6.14, and 3.5.24. </p>
</DD> </DD>
<DT><b><a name="cleanup_service_name">cleanup_service_name</a> <DT><b><a name="cleanup_service_name">cleanup_service_name</a>
@ -15304,32 +15338,118 @@ This feature is available in Postfix 2.0 and later.
<DT><b><a name="smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> <DT><b><a name="smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a>
(default: Postfix &lt; 3.9: no)</b></DT><DD> (default: Postfix &lt; 3.9: no)</b></DT><DD>
<p> Reply with "Error: bare &lt;LF&gt; received" and disconnect <p> Reject or restrict input lines from an SMTP client that end in
when a remote SMTP client sends a line ending in &lt;LF&gt;, violating &lt;LF&gt; instead of the standard &lt;CR&gt;&lt;LF&gt;. Such line
the <a href="http://tools.ietf.org/html/rfc5321">RFC 5321</a> requirement that lines must end in &lt;CR&gt;&lt;LF&gt;. endings are commonly allowed with UNIX-based SMTP servers, but they
This feature is disbled by default with Postfix &lt; 3.9. Use violate <a href="http://tools.ietf.org/html/rfc5321">RFC 5321</a>, and allowing such line endings can make a server
<a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a> to exclude non-standard clients vulnerable to <a href="https://www.postfix.org/smtp-smuggling.html">
such as netcat. Specify "<a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> = no" to disable SMTP smuggling</a>. </p>
(not recommended for an Internet-connected MTA). </p>
<p> See <a href="https://www.postfix.org/smtp-smuggling.html"> <p> Specify one of the following values (case does not matter): </p>
https://www.postfix.org/smtp-smuggling.html</a> for details.
<p> Example: </p> <dl compact>
<dt> <b>normalize</b></dt> <dd> Require the standard
End-of-DATA sequence &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;.
Otherwise, allow command or message content lines ending in the
non-standard &lt;LF&gt;, and process them as if the client sent the
standard &lt;CR&gt;&lt;LF&gt;. <br> <br> This maintains compatibility
with many legitimate SMTP client applications that send a mix of
standard and non-standard line endings, but will fail to receive
email from client implementations that do not terminate DATA content
with the standard End-of-DATA sequence
&lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;. <br> <br> Such clients
can be excluded with <a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a>. </dd>
<dt> <b>yes</b> </dt> <dd> Compatibility alias for <b>normalize</b>. </dd>
<dt> <b>reject</b> </dt> <dd> Require the standard End-of-DATA
sequence &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;. Reject a command
or message content when a line contains bare &lt;LF&gt;, log a "bare
&lt;LF&gt; received" error, and reply with the SMTP status code in
$<a href="postconf.5.html#smtpd_forbid_bare_newline_reject_code">smtpd_forbid_bare_newline_reject_code</a>. <br> <br> This will reject
email from SMTP clients that send any non-standard line endings
such as web applications, netcat, or load balancer health checks.
<br> <br> This will also reject email from services that use BDAT
to send MIME text containing a bare newline (<a href="http://tools.ietf.org/html/rfc3030">RFC 3030</a> Section 3
requires canonical MIME format for text message types, defined in
<a href="http://tools.ietf.org/html/rfc2045">RFC 2045</a> Sections 2.7 and 2.8). <br> <br> Such clients can be
excluded with <a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a> (or, in the case
of BDAT violations, BDAT can be selectively disabled with
<a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>, or globally disabled with
<a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>). </dd>
<dt> <b>no</b> (default)</dt> <dd> Do not require the standard
End-of-DATA
sequence &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;. Always process
a bare &lt;LF&gt; as if the client sent &lt;CR&gt;&lt;LF&gt;. This
option is fully backwards compatible, but is not recommended for
an Internet-facing SMTP server, because it is vulnerable to <a
href="https://www.postfix.org/smtp-smuggling.html"> SMTP smuggling</a>.
</dd>
</dl>
<p> Recommended settings: </p>
<blockquote> <blockquote>
<pre> <pre>
# Disconnect remote SMTP clients that send bare newlines, but allow # Require the standard End-of-DATA sequence &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;.
# local clients with non-standard SMTP implementations such as netcat, # Otherwise, allow bare &lt;LF&gt; and process it as if the client sent
# fax machines, or load balancer health checks. # &lt;CR&gt;&lt;LF&gt;.
# #
<a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> = yes # This maintains compatibility with many legitimate SMTP client
# applications that send a mix of standard and non-standard line
# endings, but will fail to receive email from client implementations
# that do not terminate DATA content with the standard End-of-DATA
# sequence &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;.
#
# Such clients can be allowlisted with <a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a>.
# The example below allowlists SMTP clients in trusted networks.
#
<a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> = normalize
<a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a> = $<a href="postconf.5.html#mynetworks">mynetworks</a> <a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a> = $<a href="postconf.5.html#mynetworks">mynetworks</a>
</pre> </pre>
</blockquote> </blockquote>
<p> This feature is available in Postfix &ge; 3.9, 3.8.4, 3.7.9, <p> Alternative: </p>
3.6.13, and 3.5.23. </p>
<blockquote>
<pre>
# Reject input lines that contain &lt;LF&gt; and log a "bare &lt;LF&gt; received"
# error. Require that input lines end in &lt;CR&gt;&lt;LF&gt;, and require the
# standard End-of-DATA sequence &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;.
#
# This will reject email from SMTP clients that send any non-standard
# line endings such as web applications, netcat, or load balancer
# health checks.
#
# This will also reject email from services that use BDAT to send
# MIME text containing a bare newline (<a href="http://tools.ietf.org/html/rfc3030">RFC 3030</a> Section 3 requires
# canonical MIME format for text message types, defined in <a href="http://tools.ietf.org/html/rfc2045">RFC 2045</a>
# Sections 2.7 and 2.8).
#
# Such clients can be allowlisted with <a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a>.
# The example below allowlists SMTP clients in trusted networks.
#
<a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> = reject
<a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a> = $<a href="postconf.5.html#mynetworks">mynetworks</a>
#
# Alternatively, in the case of BDAT violations, BDAT can be selectively
# disabled with <a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>, or globally
# disabled with <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>.
#
# <a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a> = <a href="cidr_table.5.html">cidr</a>:/path/to/file
# /path/to/file:
# 10.0.0.0/24 chunking, silent-discard
# <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> = chunking, silent-discard
</pre>
</blockquote>
<p> This feature with settings <b>yes</b> and <b>no</b> is available
in Postfix 3.8.4, 3.7.9, 3.6.13, and 3.5.23. Additionally, the
settings <b>reject</b>, and <b>normalize</b> are available with
Postfix &ge; 3.9, 3.8.5, 3.7.10, 3.6.14, and 3.5.24. </p>
</DD> </DD>
@ -15338,26 +15458,28 @@ https://www.postfix.org/smtp-smuggling.html</a> for details.
(default: $<a href="postconf.5.html#mynetworks">mynetworks</a>)</b></DT><DD> (default: $<a href="postconf.5.html#mynetworks">mynetworks</a>)</b></DT><DD>
<p> Exclude the specified clients from <a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> <p> Exclude the specified clients from <a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a>
enforcement. It uses the same syntax and parent-domain matching enforcement. This setting uses the same syntax and parent-domain
behavior as <a href="postconf.5.html#mynetworks">mynetworks</a>. </p> matching behavior as <a href="postconf.5.html#mynetworks">mynetworks</a>. </p>
<p> Example: </p>
<blockquote>
<pre>
# Disconnect remote SMTP clients that send bare newlines, but allow
# local clients with non-standard SMTP implementations such as netcat,
# fax machines, or load balancer health checks.
#
<a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> = yes
<a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a> = $<a href="postconf.5.html#mynetworks">mynetworks</a>
</pre>
</blockquote>
<p> This feature is available in Postfix &ge; 3.9, 3.8.4, 3.7.9, <p> This feature is available in Postfix &ge; 3.9, 3.8.4, 3.7.9,
3.6.13, and 3.5.23. </p> 3.6.13, and 3.5.23. </p>
</DD>
<DT><b><a name="smtpd_forbid_bare_newline_reject_code">smtpd_forbid_bare_newline_reject_code</a>
(default: 550)</b></DT><DD>
<p>
The numerical Postfix SMTP server response code when rejecting a
request with "<a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> = reject".
Specify a 5XX status code (521 to disconnect).
</p>
<p> This feature is available in Postfix &ge; 3.9, 3.8.5, 3.7.10,
3.6.14, and 3.5.24. </p>
</DD> </DD>
<DT><b><a name="smtpd_forbid_unauth_pipelining">smtpd_forbid_unauth_pipelining</a> <DT><b><a name="smtpd_forbid_unauth_pipelining">smtpd_forbid_unauth_pipelining</a>

17
postfix/html/smtpd.8.html
View File

@ -936,17 +936,28 @@ SMTPD(8) SMTPD(8)
Disconnect remote SMTP clients that violate <a href="http://tools.ietf.org/html/rfc2920">RFC 2920</a> (or 5321) Disconnect remote SMTP clients that violate <a href="http://tools.ietf.org/html/rfc2920">RFC 2920</a> (or 5321)
command pipelining constraints. command pipelining constraints.
Available in Postfix 3.9, 3.8.1, 3.7.6, 3.6.10, 3.5.20 and later:
<b><a href="postconf.5.html#smtpd_forbid_unauth_pipelining">smtpd_forbid_unauth_pipelining</a> (Postfix</b> &gt;<b>= 3.9: yes)</b>
Disconnect remote SMTP clients that violate <a href="https://tools.ietf.org/html/rfc2920">RFC 2920</a> (or 5321)
command pipelining constraints.
Available in Postfix 3.9, 3.8.4, 3.7.9, 3.6.13, 3.5.23 and later: Available in Postfix 3.9, 3.8.4, 3.7.9, 3.6.13, 3.5.23 and later:
<b><a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> (Postfix</b> &lt; <b>3.9: no)</b> <b><a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> (Postfix</b> &lt; <b>3.9: no)</b>
Reply with "Error: bare &lt;LF&gt; received" and disconnect when a Reject or restrict input lines from an SMTP client that end in
remote SMTP client sends a line ending in &lt;LF&gt;, violating the &lt;LF&gt; instead of the standard &lt;CR&gt;&lt;LF&gt;.
<a href="http://tools.ietf.org/html/rfc5321">RFC 5321</a> requirement that lines must end in &lt;CR&gt;&lt;LF&gt;.
<b><a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a> ($<a href="postconf.5.html#mynetworks">mynetworks</a>)</b> <b><a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a> ($<a href="postconf.5.html#mynetworks">mynetworks</a>)</b>
Exclude the specified clients from <a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> Exclude the specified clients from <a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a>
enforcement. enforcement.
Available in Postfix 3.9, 3.8.5, 3.7.10, 3.6.14, 3.5.24 and later:
<b><a href="postconf.5.html#smtpd_forbid_bare_newline_reject_code">smtpd_forbid_bare_newline_reject_code</a> (550)</b>
The numerical Postfix SMTP server response code when rejecting a
request with "<a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> = reject".
<b>TARPIT CONTROLS</b> <b>TARPIT CONTROLS</b>
When a remote SMTP client makes errors, the Postfix SMTP server can When a remote SMTP client makes errors, the Postfix SMTP server can
insert delays before responding. This can help to slow down run-away insert delays before responding. This can help to slow down run-away

189
postfix/man/man5/postconf.5
View File

@ -845,6 +845,32 @@ canonical_maps = hash:/etc/postfix/canonical
.fi .fi
.ad .ad
.ft R .ft R
.SH cleanup_replace_stray_cr_lf (default: yes)
Replace each stray <CR> or <LF> character in message
content with a space character, to prevent outbound SMTP smuggling,
and to make the evaluation of Postfix\-added DKIM or other signatures
independent from how a remote mail server handles such characters.
.PP
SMTP does not allow such characters unless they are part of a
<CR><LF> sequence, and different mail systems handle
such stray characters in an implementation\-dependent manner. Stray
<CR> or <LF> characters could be used for outbound
SMTP smuggling, where an attacker uses a Postfix server to send
message content with a non\-standard End\-of\-DATA sequence that
triggers inbound SMTP smuggling at a remote SMTP server.
.PP
The replacement happens before all other content management,
and before Postfix may add a DKIM etc. signature; if the signature
were created first, the replacement could invalidate the signature.
.PP
In addition to preventing SMTP smuggling, replacing stray
<CR> or <LF> characters ensures that the result of
signature validation by later mail system will not depend on how
that mail system handles those stray characters in an
implementation\-dependent manner.
.PP
This feature is available in Postfix >= 3.9, 3.8.5, 3.7.10,
3.6.14, and 3.5.24.
.SH cleanup_service_name (default: cleanup) .SH cleanup_service_name (default: cleanup)
The name of the \fBcleanup\fR(8) service. This service rewrites addresses The name of the \fBcleanup\fR(8) service. This service rewrites addresses
into the standard form, and performs \fBcanonical\fR(5) address mapping into the standard form, and performs \fBcanonical\fR(5) address mapping
@ -10416,60 +10442,153 @@ parameter $name expansion.
.PP .PP
This feature is available in Postfix 2.0 and later. This feature is available in Postfix 2.0 and later.
.SH smtpd_forbid_bare_newline (default: Postfix < 3.9: no) .SH smtpd_forbid_bare_newline (default: Postfix < 3.9: no)
Reply with "Error: bare <LF> received" and disconnect Reject or restrict input lines from an SMTP client that end in
when a remote SMTP client sends a line ending in <LF>, violating <LF> instead of the standard <CR><LF>. Such line
the RFC 5321 requirement that lines must end in <CR><LF>. endings are commonly allowed with UNIX\-based SMTP servers, but they
This feature is disbled by default with Postfix < 3.9. Use violate RFC 5321, and allowing such line endings can make a server
smtpd_forbid_bare_newline_exclusions to exclude non\-standard clients vulnerable to
such as netcat. Specify "smtpd_forbid_bare_newline = no" to disable SMTP smuggling.
(not recommended for an Internet\-connected MTA).
.PP .PP
See Specify one of the following values (case does not matter):
https://www.postfix.org/smtp\-smuggling.html for details. .IP "\fBnormalize\fR"
Require the standard
End\-of\-DATA sequence <CR><LF>.<CR><LF>.
Otherwise, allow command or message content lines ending in the
non\-standard <LF>, and process them as if the client sent the
standard <CR><LF>.
.br
.br
This maintains compatibility
with many legitimate SMTP client applications that send a mix of
standard and non\-standard line endings, but will fail to receive
email from client implementations that do not terminate DATA content
with the standard End\-of\-DATA sequence
<CR><LF>.<CR><LF>.
.br
.br
Such clients
can be excluded with smtpd_forbid_bare_newline_exclusions.
.br
.IP "\fByes\fR"
Compatibility alias for \fBnormalize\fR.
.br
.IP "\fBreject\fR"
Require the standard End\-of\-DATA
sequence <CR><LF>.<CR><LF>. Reject a command
or message content when a line contains bare <LF>, log a "bare
<LF> received" error, and reply with the SMTP status code in
$smtpd_forbid_bare_newline_reject_code.
.br
.br
This will reject
email from SMTP clients that send any non\-standard line endings
such as web applications, netcat, or load balancer health checks.
.br
.br
This will also reject email from services that use BDAT
to send MIME text containing a bare newline (RFC 3030 Section 3
requires canonical MIME format for text message types, defined in
RFC 2045 Sections 2.7 and 2.8).
.br
.br
Such clients can be
excluded with smtpd_forbid_bare_newline_exclusions (or, in the case
of BDAT violations, BDAT can be selectively disabled with
smtpd_discard_ehlo_keyword_address_maps, or globally disabled with
smtpd_discard_ehlo_keywords).
.br
.IP "\fBno\fR (default)"
Do not require the standard
End\-of\-DATA
sequence <CR><LF>.<CR><LF>. Always process
a bare <LF> as if the client sent <CR><LF>. This
option is fully backwards compatible, but is not recommended for
an Internet\-facing SMTP server, because it is vulnerable to SMTP smuggling.
.br
.br
.PP .PP
Example: Recommended settings:
.sp .sp
.in +4 .in +4
.nf .nf
.na .na
.ft C .ft C
# Disconnect remote SMTP clients that send bare newlines, but allow # Require the standard End\-of\-DATA sequence <CR><LF>.<CR><LF>.
# local clients with non\-standard SMTP implementations such as netcat, # Otherwise, allow bare <LF> and process it as if the client sent
# fax machines, or load balancer health checks. # <CR><LF>.
# #
smtpd_forbid_bare_newline = yes # This maintains compatibility with many legitimate SMTP client
# applications that send a mix of standard and non\-standard line
# endings, but will fail to receive email from client implementations
# that do not terminate DATA content with the standard End\-of\-DATA
# sequence <CR><LF>.<CR><LF>.
#
# Such clients can be allowlisted with smtpd_forbid_bare_newline_exclusions.
# The example below allowlists SMTP clients in trusted networks.
#
smtpd_forbid_bare_newline = normalize
smtpd_forbid_bare_newline_exclusions = $mynetworks smtpd_forbid_bare_newline_exclusions = $mynetworks
.fi .fi
.ad .ad
.ft R .ft R
.in -4 .in -4
.PP .PP
This feature is available in Postfix >= 3.9, 3.8.4, 3.7.9, Alternative:
3.6.13, and 3.5.23. .sp
.in +4
.nf
.na
.ft C
# Reject input lines that contain <LF> and log a "bare <LF> received"
# error. Require that input lines end in <CR><LF>, and require the
# standard End\-of\-DATA sequence <CR><LF>.<CR><LF>.
#
# This will reject email from SMTP clients that send any non\-standard
# line endings such as web applications, netcat, or load balancer
# health checks.
#
# This will also reject email from services that use BDAT to send
# MIME text containing a bare newline (RFC 3030 Section 3 requires
# canonical MIME format for text message types, defined in RFC 2045
# Sections 2.7 and 2.8).
#
# Such clients can be allowlisted with smtpd_forbid_bare_newline_exclusions.
# The example below allowlists SMTP clients in trusted networks.
#
smtpd_forbid_bare_newline = reject
smtpd_forbid_bare_newline_exclusions = $mynetworks
#
# Alternatively, in the case of BDAT violations, BDAT can be selectively
# disabled with smtpd_discard_ehlo_keyword_address_maps, or globally
# disabled with smtpd_discard_ehlo_keywords.
#
# smtpd_discard_ehlo_keyword_address_maps = cidr:/path/to/file
# /path/to/file:
# 10.0.0.0/24 chunking, silent\-discard
# smtpd_discard_ehlo_keywords = chunking, silent\-discard
.fi
.ad
.ft R
.in -4
.PP
This feature with settings \fByes\fR and \fBno\fR is available
in Postfix 3.8.4, 3.7.9, 3.6.13, and 3.5.23. Additionally, the
settings \fBreject\fR, and \fBnormalize\fR are available with
Postfix >= 3.9, 3.8.5, 3.7.10, 3.6.14, and 3.5.24.
.SH smtpd_forbid_bare_newline_exclusions (default: $mynetworks) .SH smtpd_forbid_bare_newline_exclusions (default: $mynetworks)
Exclude the specified clients from smtpd_forbid_bare_newline Exclude the specified clients from smtpd_forbid_bare_newline
enforcement. It uses the same syntax and parent\-domain matching enforcement. This setting uses the same syntax and parent\-domain
behavior as mynetworks. matching behavior as mynetworks.
.PP
Example:
.sp
.in +4
.nf
.na
.ft C
# Disconnect remote SMTP clients that send bare newlines, but allow
# local clients with non\-standard SMTP implementations such as netcat,
# fax machines, or load balancer health checks.
#
smtpd_forbid_bare_newline = yes
smtpd_forbid_bare_newline_exclusions = $mynetworks
.fi
.ad
.ft R
.in -4
.PP .PP
This feature is available in Postfix >= 3.9, 3.8.4, 3.7.9, This feature is available in Postfix >= 3.9, 3.8.4, 3.7.9,
3.6.13, and 3.5.23. 3.6.13, and 3.5.23.
.SH smtpd_forbid_bare_newline_reject_code (default: 550)
The numerical Postfix SMTP server response code when rejecting a
request with "smtpd_forbid_bare_newline = reject".
Specify a 5XX status code (521 to disconnect).
.PP
This feature is available in Postfix >= 3.9, 3.8.5, 3.7.10,
3.6.14, and 3.5.24.
.SH smtpd_forbid_unauth_pipelining (default: Postfix >= 3.9: yes) .SH smtpd_forbid_unauth_pipelining (default: Postfix >= 3.9: yes)
Disconnect remote SMTP clients that violate RFC 2920 (or 5321) Disconnect remote SMTP clients that violate RFC 2920 (or 5321)
command pipelining constraints. The server replies with "554 5.5.0 command pipelining constraints. The server replies with "554 5.5.0

8
postfix/man/man8/cleanup.8
View File

@ -163,6 +163,14 @@ content.
.IP "\fBmessage_strip_characters (empty)\fR" .IP "\fBmessage_strip_characters (empty)\fR"
The set of characters that Postfix will remove from message The set of characters that Postfix will remove from message
content. content.
.PP
Available in Postfix version 3.9, 3.8.5, 3.7.10, 3.6.14,
3.5.24, and later:
.IP "\fBcleanup_replace_stray_cr_lf (yes)\fR"
Replace each stray <CR> or <LF> character in message
content with a space character, to prevent outbound SMTP smuggling,
and to make the evaluation of Postfix\-added DKIM or other signatures
independent from how a remote mail server handles such characters.
.SH "BEFORE QUEUE MILTER CONTROLS" .SH "BEFORE QUEUE MILTER CONTROLS"
.na .na
.nf .nf

16
postfix/man/man8/smtpd.8
View File

@ -816,19 +816,19 @@ The maximal number of AUTH commands that any client is allowed to
send to this service per time unit, regardless of whether or not send to this service per time unit, regardless of whether or not
Postfix actually accepts those commands. Postfix actually accepts those commands.
.PP .PP
Available in Postfix 3.9, 3.8.1, 3.7.6, 3.6.10, 3.5.20 and later:
.IP "\fBsmtpd_forbid_unauth_pipelining (Postfix >= 3.9: yes)\fR"
Disconnect remote SMTP clients that violate RFC 2920 (or 5321)
command pipelining constraints.
.PP
Available in Postfix 3.9, 3.8.4, 3.7.9, 3.6.13, 3.5.23 and later: Available in Postfix 3.9, 3.8.4, 3.7.9, 3.6.13, 3.5.23 and later:
.IP "\fBsmtpd_forbid_bare_newline (Postfix < 3.9: no)\fR" .IP "\fBsmtpd_forbid_bare_newline (Postfix < 3.9: no)\fR"
Reply with "Error: bare <LF> received" and disconnect Reject or restrict input lines from an SMTP client that end in
when a remote SMTP client sends a line ending in <LF>, violating <LF> instead of the standard <CR><LF>.
the RFC 5321 requirement that lines must end in <CR><LF>.
.IP "\fBsmtpd_forbid_bare_newline_exclusions ($mynetworks)\fR" .IP "\fBsmtpd_forbid_bare_newline_exclusions ($mynetworks)\fR"
Exclude the specified clients from smtpd_forbid_bare_newline Exclude the specified clients from smtpd_forbid_bare_newline
enforcement. enforcement.
.PP
Available in Postfix 3.9, 3.8.5, 3.7.10, 3.6.14, 3.5.24 and
later:
.IP "\fBsmtpd_forbid_bare_newline_reject_code (550)\fR"
The numerical Postfix SMTP server response code when rejecting a
request with "smtpd_forbid_bare_newline = reject".
.SH "TARPIT CONTROLS" .SH "TARPIT CONTROLS"
.na .na
.nf .nf

6
postfix/mantools/postlink
View File

@ -548,8 +548,10 @@ while (<>) {
s;\bsmtpd_etrn_restrictions\b;<a href="postconf.5.html#smtpd_etrn_restrictions">$&</a>;g; s;\bsmtpd_etrn_restrictions\b;<a href="postconf.5.html#smtpd_etrn_restrictions">$&</a>;g;
s;\bsmtpd_expansion_filter\b;<a href="postconf.5.html#smtpd_expansion_filter">$&</a>;g; s;\bsmtpd_expansion_filter\b;<a href="postconf.5.html#smtpd_expansion_filter">$&</a>;g;
s;\bsmtpd_for[-</bB>]*\n*[ <bB>]*bidden_commands\b;<a href="postconf.5.html#smtpd_forbidden_commands">$&</a>;g; s;\bsmtpd_for[-</bB>]*\n*[ <bB>]*bidden_commands\b;<a href="postconf.5.html#smtpd_forbidden_commands">$&</a>;g;
s;\bsmtpd_for[-</bB>]*\n*[ <bB>]*bid_bare_newline\b;<a href="postconf.5.html#smtpd_forbid_bare_newline">$&</a>;g; s;\bsmtpd_for[-</bB>]*\n*[ <bB>]*bid_bare_new[-</bB>]*\n*[ <bB>]*line\b;<a href="postconf.5.html#smtpd_forbid_bare_newline">$&</a>;g;
s;\bsmtpd_for[-</bB>]*\n*[ <bB>]*bid_bare_newline_exclusions\b;<a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">$&</a>;g; s;\bsmtpd_for[-</bB>]*\n*[ <bB>]*bid_bare_new[-</bB>]*\n*[ <bB>]*line_reject_code\b;<a href="postconf.5.html#smtpd_forbid_bare_newline_reject_code">$&</a>;g;
s;\bsmtpd_for[-</bB>]*\n*[ <bB>]*bid_bare_new[-</bB>]*\n*[ <bB>]*line_exclusions\b;<a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">$&</a>;g;
s;\bcleanup_replace_stray_cr_lf\b;<a href="postconf.5.html#cleanup_replace_stray_cr_lf">$&</a>;g;
s;\bsmtpd_for[-</bB>]*\n*[ <bB>]*bid_unauth_pipelining\b;<a href="postconf.5.html#smtpd_forbid_unauth_pipelining">$&</a>;g; s;\bsmtpd_for[-</bB>]*\n*[ <bB>]*bid_unauth_pipelining\b;<a href="postconf.5.html#smtpd_forbid_unauth_pipelining">$&</a>;g;
s;\bsmtpd_hard_error_limit\b;<a href="postconf.5.html#smtpd_hard_error_limit">$&</a>;g; s;\bsmtpd_hard_error_limit\b;<a href="postconf.5.html#smtpd_hard_error_limit">$&</a>;g;
s;\bsmtpd_helo_required\b;<a href="postconf.5.html#smtpd_helo_required">$&</a>;g; s;\bsmtpd_helo_required\b;<a href="postconf.5.html#smtpd_helo_required">$&</a>;g;

176
postfix/proto/postconf.proto
View File

@ -18163,55 +18163,169 @@ MinProtocol = TLSv1
%PARAM smtpd_forbid_bare_newline Postfix &lt; 3.9: no %PARAM smtpd_forbid_bare_newline Postfix &lt; 3.9: no
<p> Reply with "Error: bare &lt;LF&gt; received" and disconnect <p> Reject or restrict input lines from an SMTP client that end in
when a remote SMTP client sends a line ending in &lt;LF&gt;, violating &lt;LF&gt; instead of the standard &lt;CR&gt;&lt;LF&gt;. Such line
the RFC 5321 requirement that lines must end in &lt;CR&gt;&lt;LF&gt;. endings are commonly allowed with UNIX-based SMTP servers, but they
This feature is disbled by default with Postfix &lt; 3.9. Use violate RFC 5321, and allowing such line endings can make a server
smtpd_forbid_bare_newline_exclusions to exclude non-standard clients vulnerable to <a href="https://www.postfix.org/smtp-smuggling.html">
such as netcat. Specify "smtpd_forbid_bare_newline = no" to disable SMTP smuggling</a>. </p>
(not recommended for an Internet-connected MTA). </p>
<p> See <a href="https://www.postfix.org/smtp-smuggling.html"> <p> Specify one of the following values (case does not matter): </p>
https://www.postfix.org/smtp-smuggling.html</a> for details.
<p> Example: </p> <dl compact>
<dt> <b>normalize</b></dt> <dd> Require the standard
End-of-DATA sequence &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;.
Otherwise, allow command or message content lines ending in the
non-standard &lt;LF&gt;, and process them as if the client sent the
standard &lt;CR&gt;&lt;LF&gt;. <br> <br> This maintains compatibility
with many legitimate SMTP client applications that send a mix of
standard and non-standard line endings, but will fail to receive
email from client implementations that do not terminate DATA content
with the standard End-of-DATA sequence
&lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;. <br> <br> Such clients
can be excluded with smtpd_forbid_bare_newline_exclusions. </dd>
<dt> <b>yes</b> </dt> <dd> Compatibility alias for <b>normalize</b>. </dd>
<dt> <b>reject</b> </dt> <dd> Require the standard End-of-DATA
sequence &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;. Reject a command
or message content when a line contains bare &lt;LF&gt;, log a "bare
&lt;LF&gt; received" error, and reply with the SMTP status code in
$smtpd_forbid_bare_newline_reject_code. <br> <br> This will reject
email from SMTP clients that send any non-standard line endings
such as web applications, netcat, or load balancer health checks.
<br> <br> This will also reject email from services that use BDAT
to send MIME text containing a bare newline (RFC 3030 Section 3
requires canonical MIME format for text message types, defined in
RFC 2045 Sections 2.7 and 2.8). <br> <br> Such clients can be
excluded with smtpd_forbid_bare_newline_exclusions (or, in the case
of BDAT violations, BDAT can be selectively disabled with
smtpd_discard_ehlo_keyword_address_maps, or globally disabled with
smtpd_discard_ehlo_keywords). </dd>
<dt> <b>no</b> (default)</dt> <dd> Do not require the standard
End-of-DATA
sequence &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;. Always process
a bare &lt;LF&gt; as if the client sent &lt;CR&gt;&lt;LF&gt;. This
option is fully backwards compatible, but is not recommended for
an Internet-facing SMTP server, because it is vulnerable to <a
href="https://www.postfix.org/smtp-smuggling.html"> SMTP smuggling</a>.
</dd>
</dl>
<p> Recommended settings: </p>
<blockquote> <blockquote>
<pre> <pre>
# Disconnect remote SMTP clients that send bare newlines, but allow # Require the standard End-of-DATA sequence &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;.
# local clients with non-standard SMTP implementations such as netcat, # Otherwise, allow bare &lt;LF&gt; and process it as if the client sent
# fax machines, or load balancer health checks. # &lt;CR&gt;&lt;LF&gt;.
# #
smtpd_forbid_bare_newline = yes # This maintains compatibility with many legitimate SMTP client
# applications that send a mix of standard and non-standard line
# endings, but will fail to receive email from client implementations
# that do not terminate DATA content with the standard End-of-DATA
# sequence &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;.
#
# Such clients can be allowlisted with smtpd_forbid_bare_newline_exclusions.
# The example below allowlists SMTP clients in trusted networks.
#
smtpd_forbid_bare_newline = normalize
smtpd_forbid_bare_newline_exclusions = $mynetworks smtpd_forbid_bare_newline_exclusions = $mynetworks
</pre> </pre>
</blockquote> </blockquote>
<p> This feature is available in Postfix &ge; 3.9, 3.8.4, 3.7.9, <p> Alternative: </p>
3.6.13, and 3.5.23. </p>
<blockquote>
<pre>
# Reject input lines that contain &lt;LF&gt; and log a "bare &lt;LF&gt; received"
# error. Require that input lines end in &lt;CR&gt;&lt;LF&gt;, and require the
# standard End-of-DATA sequence &lt;CR&gt;&lt;LF&gt;.&lt;CR&gt;&lt;LF&gt;.
#
# This will reject email from SMTP clients that send any non-standard
# line endings such as web applications, netcat, or load balancer
# health checks.
#
# This will also reject email from services that use BDAT to send
# MIME text containing a bare newline (RFC 3030 Section 3 requires
# canonical MIME format for text message types, defined in RFC 2045
# Sections 2.7 and 2.8).
#
# Such clients can be allowlisted with smtpd_forbid_bare_newline_exclusions.
# The example below allowlists SMTP clients in trusted networks.
#
smtpd_forbid_bare_newline = reject
smtpd_forbid_bare_newline_exclusions = $mynetworks
#
# Alternatively, in the case of BDAT violations, BDAT can be selectively
# disabled with smtpd_discard_ehlo_keyword_address_maps, or globally
# disabled with smtpd_discard_ehlo_keywords.
#
# smtpd_discard_ehlo_keyword_address_maps = cidr:/path/to/file
# /path/to/file:
# 10.0.0.0/24 chunking, silent-discard
# smtpd_discard_ehlo_keywords = chunking, silent-discard
</pre>
</blockquote>
<p> This feature with settings <b>yes</b> and <b>no</b> is available
in Postfix 3.8.4, 3.7.9, 3.6.13, and 3.5.23. Additionally, the
settings <b>reject</b>, and <b>normalize</b> are available with
Postfix &ge; 3.9, 3.8.5, 3.7.10, 3.6.14, and 3.5.24. </p>
%PARAM smtpd_forbid_bare_newline_exclusions $mynetworks %PARAM smtpd_forbid_bare_newline_exclusions $mynetworks
<p> Exclude the specified clients from smtpd_forbid_bare_newline <p> Exclude the specified clients from smtpd_forbid_bare_newline
enforcement. It uses the same syntax and parent-domain matching enforcement. This setting uses the same syntax and parent-domain
behavior as mynetworks. </p> matching behavior as mynetworks. </p>
<p> Example: </p>
<blockquote>
<pre>
# Disconnect remote SMTP clients that send bare newlines, but allow
# local clients with non-standard SMTP implementations such as netcat,
# fax machines, or load balancer health checks.
#
smtpd_forbid_bare_newline = yes
smtpd_forbid_bare_newline_exclusions = $mynetworks
</pre>
</blockquote>
<p> This feature is available in Postfix &ge; 3.9, 3.8.4, 3.7.9, <p> This feature is available in Postfix &ge; 3.9, 3.8.4, 3.7.9,
3.6.13, and 3.5.23. </p> 3.6.13, and 3.5.23. </p>
%PARAM smtpd_forbid_bare_newline_reject_code 550
<p>
The numerical Postfix SMTP server response code when rejecting a
request with "smtpd_forbid_bare_newline = reject".
Specify a 5XX status code (521 to disconnect).
</p>
<p> This feature is available in Postfix &ge; 3.9, 3.8.5, 3.7.10,
3.6.14, and 3.5.24. </p>
%PARAM cleanup_replace_stray_cr_lf yes
<p> Replace each stray &lt;CR&gt; or &lt;LF&gt; character in message
content with a space character, to prevent outbound SMTP smuggling,
and to make the evaluation of Postfix-added DKIM or other signatures
independent from how a remote mail server handles such characters.
</p>
<p> SMTP does not allow such characters unless they are part of a
&lt;CR&gt;&lt;LF&gt; sequence, and different mail systems handle
such stray characters in an implementation-dependent manner. Stray
&lt;CR&gt; or &lt;LF&gt; characters could be used for outbound
SMTP smuggling, where an attacker uses a Postfix server to send
message content with a non-standard End-of-DATA sequence that
triggers inbound SMTP smuggling at a remote SMTP server.</p>
<p> The replacement happens before all other content management,
and before Postfix may add a DKIM etc. signature; if the signature
were created first, the replacement could invalidate the signature.
</p>
<p> In addition to preventing SMTP smuggling, replacing stray
&lt;CR&gt; or &lt;LF&gt; characters ensures that the result of
signature validation by later mail system will not depend on how
that mail system handles those stray characters in an
implementation-dependent manner. </p>
<p> This feature is available in Postfix &ge; 3.9, 3.8.5, 3.7.10,
3.6.14, and 3.5.24. </p>
%PARAM smtpd_forbid_unauth_pipelining Postfix &ge; 3.9: yes %PARAM smtpd_forbid_unauth_pipelining Postfix &ge; 3.9: yes
<p> Disconnect remote SMTP clients that violate RFC 2920 (or 5321) <p> Disconnect remote SMTP clients that violate RFC 2920 (or 5321)

8
postfix/src/cleanup/cleanup.c
View File

@ -145,6 +145,14 @@
/* .IP "\fBmessage_strip_characters (empty)\fR" /* .IP "\fBmessage_strip_characters (empty)\fR"
/* The set of characters that Postfix will remove from message /* The set of characters that Postfix will remove from message
/* content. /* content.
/* .PP
/* Available in Postfix version 3.9, 3.8.5, 3.7.10, 3.6.14,
/* 3.5.24, and later:
/* .IP "\fBcleanup_replace_stray_cr_lf (yes)\fR"
/* Replace each stray <CR> or <LF> character in message
/* content with a space character, to prevent outbound SMTP smuggling,
/* and to make the evaluation of Postfix-added DKIM or other signatures
/* independent from how a remote mail server handles such characters.
/* BEFORE QUEUE MILTER CONTROLS /* BEFORE QUEUE MILTER CONTROLS
/* .ad /* .ad
/* .fi /* .fi

2
postfix/src/cleanup/cleanup_init.c
View File

@ -173,6 +173,7 @@ int var_auto_8bit_enc_hdr; /* auto-detect 8bit encoding header */
int var_always_add_hdrs; /* always add missing headers */ int var_always_add_hdrs; /* always add missing headers */
int var_virt_addrlen_limit; /* stop exponential growth */ int var_virt_addrlen_limit; /* stop exponential growth */
char *var_hfrom_format; /* header_from_format */ char *var_hfrom_format; /* header_from_format */
int var_cleanup_mask_stray_cr_lf; /* replace stray CR or LF with space */
const CONFIG_INT_TABLE cleanup_int_table[] = { const CONFIG_INT_TABLE cleanup_int_table[] = {
VAR_HOPCOUNT_LIMIT, DEF_HOPCOUNT_LIMIT, &var_hopcount_limit, 1, 0, VAR_HOPCOUNT_LIMIT, DEF_HOPCOUNT_LIMIT, &var_hopcount_limit, 1, 0,
@ -189,6 +190,7 @@ const CONFIG_BOOL_TABLE cleanup_bool_table[] = {
VAR_VERP_BOUNCE_OFF, DEF_VERP_BOUNCE_OFF, &var_verp_bounce_off, VAR_VERP_BOUNCE_OFF, DEF_VERP_BOUNCE_OFF, &var_verp_bounce_off,
VAR_AUTO_8BIT_ENC_HDR, DEF_AUTO_8BIT_ENC_HDR, &var_auto_8bit_enc_hdr, VAR_AUTO_8BIT_ENC_HDR, DEF_AUTO_8BIT_ENC_HDR, &var_auto_8bit_enc_hdr,
VAR_ALWAYS_ADD_HDRS, DEF_ALWAYS_ADD_HDRS, &var_always_add_hdrs, VAR_ALWAYS_ADD_HDRS, DEF_ALWAYS_ADD_HDRS, &var_always_add_hdrs,
VAR_CLEANUP_MASK_STRAY_CR_LF, DEF_CLEANUP_MASK_STRAY_CR_LF, &var_cleanup_mask_stray_cr_lf,
0, 0,
}; };

17
postfix/src/cleanup/cleanup_message.c
View File

@ -929,6 +929,23 @@ static void cleanup_message_headerbody(CLEANUP_STATE *state, int type,
const char *cp; const char *cp;
char *dst; char *dst;
/*
* Replace each stray CR or LF with one space. These are not allowed in
* SMTP, and can be used to enable outbound (remote) SMTP smuggling.
* Replacing these early ensures that our later DKIM etc. signature will
* not be invalidated. Besides preventing SMTP smuggling, replacing stray
* <CR> or <LF> ensures that the result of signature validation by a
* later mail system will not depend on how that mail system handles
* those stray characters in an implementation-dependent manner.
*
* The input length is not changed, therefore it is safe to overwrite the
* input.
*/
if (var_cleanup_mask_stray_cr_lf)
for (dst = (char *) buf; dst < buf + len; dst++)
if (*dst == '\r' || *dst == '\n')
*dst = ' ';
/* /*
* Reject unwanted characters. * Reject unwanted characters.
* *

1
postfix/src/global/cleanup_strerror.c
View File

@ -73,6 +73,7 @@ static const CLEANUP_STAT_DETAIL cleanup_stat_map[] = {
CLEANUP_STAT_CONT, 550, "5.7.1", "message content rejected", CLEANUP_STAT_CONT, 550, "5.7.1", "message content rejected",
CLEANUP_STAT_WRITE, 451, "4.3.0", "queue file write error", CLEANUP_STAT_WRITE, 451, "4.3.0", "queue file write error",
CLEANUP_STAT_NOPERM, 550, "5.7.1", "service denied", CLEANUP_STAT_NOPERM, 550, "5.7.1", "service denied",
CLEANUP_STAT_BARE_LF, 521, "5.5.2", "bare <LF> received",
}; };
static CLEANUP_STAT_DETAIL cleanup_stat_success = { static CLEANUP_STAT_DETAIL cleanup_stat_success = {

6
postfix/src/global/cleanup_user.h
View File

@ -64,6 +64,12 @@
#define CLEANUP_STAT_DEFER (1<<8) /* Temporary reject */ #define CLEANUP_STAT_DEFER (1<<8) /* Temporary reject */
#define CLEANUP_STAT_NOPERM (1<<9) /* Denied by non-content policy */ #define CLEANUP_STAT_NOPERM (1<<9) /* Denied by non-content policy */
/*
* Non-cleanup errors that live in the same bitmask space, to centralize
* error handling.
*/
#define CLEANUP_STAT_BARE_LF (1<<16) /* Bare <LF> received */
/* /*
* These are set when we can't bounce even if we were asked to. * These are set when we can't bounce even if we were asked to.
*/ */

9
postfix/src/global/mail_params.h
View File

@ -4212,11 +4212,18 @@ extern char *var_smtpd_dns_re_filter;
* Backwards compatibility. * Backwards compatibility.
*/ */
#define VAR_SMTPD_FORBID_BARE_LF "smtpd_forbid_bare_newline" #define VAR_SMTPD_FORBID_BARE_LF "smtpd_forbid_bare_newline"
#define DEF_SMTPD_FORBID_BARE_LF 0 #define DEF_SMTPD_FORBID_BARE_LF "no"
#define VAR_SMTPD_FORBID_BARE_LF_EXCL "smtpd_forbid_bare_newline_exclusions" #define VAR_SMTPD_FORBID_BARE_LF_EXCL "smtpd_forbid_bare_newline_exclusions"
#define DEF_SMTPD_FORBID_BARE_LF_EXCL "$" VAR_MYNETWORKS #define DEF_SMTPD_FORBID_BARE_LF_EXCL "$" VAR_MYNETWORKS
#define VAR_SMTPD_FORBID_BARE_LF_CODE "smtpd_forbid_bare_newline_reject_code"
#define DEF_SMTPD_FORBID_BARE_LF_CODE 550
#define VAR_CLEANUP_MASK_STRAY_CR_LF "cleanup_replace_stray_cr_lf"
#define DEF_CLEANUP_MASK_STRAY_CR_LF 1
extern int var_cleanup_mask_stray_cr_lf;
/* /*
* Share TLS sessions through tlsproxy(8). * Share TLS sessions through tlsproxy(8).
*/ */

4
postfix/src/global/mail_version.h
View File

@ -20,8 +20,8 @@
* Patches change both the patchlevel and the release date. Snapshots have no * Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only. * patchlevel; they change the release date only.
*/ */
#define MAIL_RELEASE_DATE "20231222" #define MAIL_RELEASE_DATE "20240121"
#define MAIL_VERSION_NUMBER "3.6.13" #define MAIL_VERSION_NUMBER "3.6.14"
#ifdef SNAPSHOT #ifdef SNAPSHOT
#define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE #define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE

30
postfix/src/global/smtp_stream.c
View File

@ -51,7 +51,8 @@
/* char *format; /* char *format;
/* va_list ap; /* va_list ap;
/* /*
/* int smtp_forbid_bare_lf; /* int smtp_detect_bare_lf;
/* int smtp_got_bare_lf;
/* AUXILIARY API /* AUXILIARY API
/* int smtp_get_noexcept(vp, stream, maxlen, flags) /* int smtp_get_noexcept(vp, stream, maxlen, flags)
/* VSTRING *vp; /* VSTRING *vp;
@ -126,16 +127,16 @@
/* smtp_vprintf() is the machine underneath smtp_printf(). /* smtp_vprintf() is the machine underneath smtp_printf().
/* /*
/* smtp_get_noexcept() implements the subset of smtp_get() /* smtp_get_noexcept() implements the subset of smtp_get()
/* without long jumps for timeout or EOF errors. Instead, /* without timeouts and without making long jumps. Instead,
/* query the stream status with vstream_feof() etc. /* query the stream status with vstream_feof() etc.
/* This function will make a VSTREAM long jump (error code /*
/* SMTP_ERR_LF) when rejecting input with a bare newline byte. /* This function assigns smtp_got_bare_lf = smtp_detect_bare_lf,
/* if smtp_detect_bare_lf is non-zero and the last read line
/* was terminated with a bare newline. Otherwise, this function
/* sets smtp_got_bare_lf to zero.
/* /*
/* smtp_timeout_setup() is a backwards-compatibility interface /* smtp_timeout_setup() is a backwards-compatibility interface
/* for programs that don't require per-record deadline support. /* for programs that don't require per-record deadline support.
/*
/* smtp_forbid_bare_lf controls whether smtp_get_noexcept()
/* will reject input with a bare newline byte.
/* DIAGNOSTICS /* DIAGNOSTICS
/* .fi /* .fi
/* .ad /* .ad
@ -208,7 +209,8 @@
#include "smtp_stream.h" #include "smtp_stream.h"
int smtp_forbid_bare_lf; int smtp_detect_bare_lf;
int smtp_got_bare_lf;
/* smtp_timeout_reset - reset per-stream error flags, restart deadline timer */ /* smtp_timeout_reset - reset per-stream error flags, restart deadline timer */
@ -371,6 +373,8 @@ int smtp_get_noexcept(VSTRING *vp, VSTREAM *stream, ssize_t bound, int flags
int last_char; int last_char;
int next_char; int next_char;
smtp_got_bare_lf = 0;
/* /*
* It's painful to do I/O with records that may span multiple buffers. * It's painful to do I/O with records that may span multiple buffers.
* Allow for partial long lines (we will read the remainder later) and * Allow for partial long lines (we will read the remainder later) and
@ -413,11 +417,15 @@ int smtp_get_noexcept(VSTRING *vp, VSTREAM *stream, ssize_t bound, int flags
*/ */
case '\n': case '\n':
vstring_truncate(vp, VSTRING_LEN(vp) - 1); vstring_truncate(vp, VSTRING_LEN(vp) - 1);
if (smtp_forbid_bare_lf if (smtp_detect_bare_lf) {
&& (VSTRING_LEN(vp) == 0 || vstring_end(vp)[-1] != '\r')) if (VSTRING_LEN(vp) == 0 || vstring_end(vp)[-1] != '\r')
vstream_longjmp(stream, SMTP_ERR_LF); smtp_got_bare_lf = smtp_detect_bare_lf;
else
vstring_truncate(vp, VSTRING_LEN(vp) - 1);
} else {
while (VSTRING_LEN(vp) > 0 && vstring_end(vp)[-1] == '\r') while (VSTRING_LEN(vp) > 0 && vstring_end(vp)[-1] == '\r')
vstring_truncate(vp, VSTRING_LEN(vp) - 1); vstring_truncate(vp, VSTRING_LEN(vp) - 1);
}
VSTRING_TERMINATE(vp); VSTRING_TERMINATE(vp);
/* FALLTRHOUGH */ /* FALLTRHOUGH */

4
postfix/src/global/smtp_stream.h
View File

@ -32,7 +32,6 @@
#define SMTP_ERR_QUIET 3 /* silent cleanup (application) */ #define SMTP_ERR_QUIET 3 /* silent cleanup (application) */
#define SMTP_ERR_NONE 4 /* non-error case */ #define SMTP_ERR_NONE 4 /* non-error case */
#define SMTP_ERR_DATA 5 /* application data error */ #define SMTP_ERR_DATA 5 /* application data error */
#define SMTP_ERR_LF 6 /* bare <LF> protocol error */
extern void smtp_stream_setup(VSTREAM *, int, int); extern void smtp_stream_setup(VSTREAM *, int, int);
extern void PRINTFLIKE(2, 3) smtp_printf(VSTREAM *, const char *,...); extern void PRINTFLIKE(2, 3) smtp_printf(VSTREAM *, const char *,...);
@ -44,7 +43,8 @@ extern void smtp_fputs(const char *, ssize_t len, VSTREAM *);
extern void smtp_fwrite(const char *, ssize_t len, VSTREAM *); extern void smtp_fwrite(const char *, ssize_t len, VSTREAM *);
extern void smtp_fread_buf(VSTRING *, ssize_t len, VSTREAM *); extern void smtp_fread_buf(VSTRING *, ssize_t len, VSTREAM *);
extern void smtp_fputc(int, VSTREAM *); extern void smtp_fputc(int, VSTREAM *);
extern int smtp_forbid_bare_lf; extern int smtp_detect_bare_lf;
extern int smtp_got_bare_lf;
extern void smtp_vprintf(VSTREAM *, const char *, va_list); extern void smtp_vprintf(VSTREAM *, const char *, va_list);

112
postfix/src/smtpd/smtpd.c
View File

@ -777,12 +777,17 @@
/* .PP /* .PP
/* Available in Postfix 3.9, 3.8.4, 3.7.9, 3.6.13, 3.5.23 and later: /* Available in Postfix 3.9, 3.8.4, 3.7.9, 3.6.13, 3.5.23 and later:
/* .IP "\fBsmtpd_forbid_bare_newline (Postfix < 3.9: no)\fR" /* .IP "\fBsmtpd_forbid_bare_newline (Postfix < 3.9: no)\fR"
/* Reply with "Error: bare <LF> received" and disconnect /* Reject or restrict input lines from an SMTP client that end in
/* when a remote SMTP client sends a line ending in <LF>, violating /* <LF> instead of the standard <CR><LF>.
/* the RFC 5321 requirement that lines must end in <CR><LF>.
/* .IP "\fBsmtpd_forbid_bare_newline_exclusions ($mynetworks)\fR" /* .IP "\fBsmtpd_forbid_bare_newline_exclusions ($mynetworks)\fR"
/* Exclude the specified clients from smtpd_forbid_bare_newline /* Exclude the specified clients from smtpd_forbid_bare_newline
/* enforcement. /* enforcement.
/* .PP
/* Available in Postfix 3.9, 3.8.5, 3.7.10, 3.6.14, 3.5.24 and
/* later:
/* .IP "\fBsmtpd_forbid_bare_newline_reject_code (550)\fR"
/* The numerical Postfix SMTP server response code when rejecting a
/* request with "smtpd_forbid_bare_newline = reject".
/* TARPIT CONTROLS /* TARPIT CONTROLS
/* .ad /* .ad
/* .fi /* .fi
@ -1489,8 +1494,10 @@ char *var_smtpd_uproxy_proto;
int var_smtpd_uproxy_tmout; int var_smtpd_uproxy_tmout;
bool var_relay_before_rcpt_checks; bool var_relay_before_rcpt_checks;
bool var_smtpd_forbid_bare_lf; char *var_smtpd_forbid_bare_lf;
char *var_smtpd_forbid_bare_lf_excl; char *var_smtpd_forbid_bare_lf_excl;
int var_smtpd_forbid_bare_lf_code;
static int bare_lf_mask;
static NAMADR_LIST *bare_lf_excl; static NAMADR_LIST *bare_lf_excl;
/* /*
@ -1567,7 +1574,6 @@ static void tls_reset(SMTPD_STATE *);
#define REASON_TIMEOUT "timeout" #define REASON_TIMEOUT "timeout"
#define REASON_LOST_CONNECTION "lost connection" #define REASON_LOST_CONNECTION "lost connection"
#define REASON_ERROR_LIMIT "too many errors" #define REASON_ERROR_LIMIT "too many errors"
#define REASON_BARE_LF "bare <LF> received"
#ifdef USE_TLS #ifdef USE_TLS
@ -1586,6 +1592,40 @@ static int ask_client_cert;
*/ */
static DICT *smtpd_cmd_filter; static DICT *smtpd_cmd_filter;
/*
* Bare LF and End-of-DATA controls (bare CR is handled elsewhere).
*
* At the smtp_get*() line reader level, setting any of these flags in the
* smtp_detect_bare_lf variable enables the detection of bare newlines. The
* line reader will set the same flags in the smtp_got_bare_lf variable
* after it detects a bare newline, otherwise it clears smtp_got_bare_lf.
*
* At the SMTP command level, the flags in smtp_got_bare_lf control whether
* commands ending in a bare newline are rejected.
*
* At the DATA and BDAT content level, the flags in smtp_got_bare_lf control
* whether the standard End-of-DATA sequence CRLF.CRLF is required, and
* whether lines ending in bare newlines are rejected.
*
* Postfix implements "delayed reject" after detecting a bare newline in BDAT
* or DATA content. The SMTP server delays a REJECT response until the
* command is finished, instead of replying and hanging up immediately. The
* End-of-DATA detection is secured with BARE_LF_FLAG_WANT_STD_EOD.
*/
#define BARE_LF_FLAG_WANT_STD_EOD (1<<0) /* Require CRLF.CRLF */
#define BARE_LF_FLAG_REPLY_REJECT (1<<1) /* Reject bare newline */
#define IS_BARE_LF_WANT_STD_EOD(m) ((m) & BARE_LF_FLAG_WANT_STD_EOD)
#define IS_BARE_LF_REPLY_REJECT(m) ((m) & BARE_LF_FLAG_REPLY_REJECT)
static const NAME_CODE bare_lf_mask_table[] = {
"normalize", BARE_LF_FLAG_WANT_STD_EOD, /* Default */
"yes", BARE_LF_FLAG_WANT_STD_EOD, /* Migration aid */
"reject", BARE_LF_FLAG_WANT_STD_EOD | BARE_LF_FLAG_REPLY_REJECT,
"no", 0,
0, -1, /* error */
};
#ifdef USE_SASL_AUTH #ifdef USE_SASL_AUTH
/* /*
@ -3528,6 +3568,7 @@ static void receive_data_message(SMTPD_STATE *state,
int curr_rec_type; int curr_rec_type;
int prev_rec_type; int prev_rec_type;
int first = 1; int first = 1;
int prev_got_bare_lf = 0;
/* /*
* Copy the message content. If the cleanup process has a problem, keep * Copy the message content. If the cleanup process has a problem, keep
@ -3541,12 +3582,15 @@ static void receive_data_message(SMTPD_STATE *state,
* XXX Deal with UNIX-style From_ lines at the start of message content * XXX Deal with UNIX-style From_ lines at the start of message content
* because sendmail permits it. * because sendmail permits it.
*/ */
for (prev_rec_type = 0; /* void */ ; prev_rec_type = curr_rec_type) { for (prev_rec_type = 0; /* void */ ; prev_rec_type = curr_rec_type,
prev_got_bare_lf = smtp_got_bare_lf) {
if (smtp_get(state->buffer, state->client, var_line_limit, if (smtp_get(state->buffer, state->client, var_line_limit,
SMTP_GET_FLAG_NONE) == '\n') SMTP_GET_FLAG_NONE) == '\n')
curr_rec_type = REC_TYPE_NORM; curr_rec_type = REC_TYPE_NORM;
else else
curr_rec_type = REC_TYPE_CONT; curr_rec_type = REC_TYPE_CONT;
if (IS_BARE_LF_REPLY_REJECT(smtp_got_bare_lf))
state->err |= CLEANUP_STAT_BARE_LF;
start = vstring_str(state->buffer); start = vstring_str(state->buffer);
len = VSTRING_LEN(state->buffer); len = VSTRING_LEN(state->buffer);
if (first) { if (first) {
@ -3559,9 +3603,14 @@ static void receive_data_message(SMTPD_STATE *state,
if (len > 0 && IS_SPACE_TAB(start[0])) if (len > 0 && IS_SPACE_TAB(start[0]))
out_record(out_stream, REC_TYPE_NORM, "", 0); out_record(out_stream, REC_TYPE_NORM, "", 0);
} }
if (prev_rec_type != REC_TYPE_CONT && *start == '.' if (prev_rec_type != REC_TYPE_CONT && *start == '.') {
&& (proxy == 0 ? (++start, --len) == 0 : len == 1)) if (len == 1 && IS_BARE_LF_WANT_STD_EOD(smtp_detect_bare_lf)
&& (smtp_got_bare_lf || prev_got_bare_lf))
/* Do not store or send to proxy filter. */
continue;
if (proxy == 0 ? (++start, --len) == 0 : len == 1)
break; break;
}
if (state->err == CLEANUP_STAT_OK) { if (state->err == CLEANUP_STAT_OK) {
if (ENFORCING_SIZE_LIMIT(var_message_limit) if (ENFORCING_SIZE_LIMIT(var_message_limit)
&& var_message_limit - state->act_size < len + 2) { && var_message_limit - state->act_size < len + 2) {
@ -3714,6 +3763,11 @@ static int common_post_message_handling(SMTPD_STATE *state)
else else
smtpd_chat_reply(state, smtpd_chat_reply(state,
"250 2.0.0 Ok: queued as %s", state->queue_id); "250 2.0.0 Ok: queued as %s", state->queue_id);
} else if ((state->err & CLEANUP_STAT_BARE_LF) != 0) {
state->error_mask |= MAIL_ERROR_PROTOCOL;
log_whatsup(state, "reject", "bare <LF> received");
smtpd_chat_reply(state, "%d 5.5.2 %s Error: bare <LF> received",
var_smtpd_forbid_bare_lf_code, var_myhostname);
} else if (why && IS_SMTP_REJECT(STR(why))) { } else if (why && IS_SMTP_REJECT(STR(why))) {
state->error_mask |= MAIL_ERROR_POLICY; state->error_mask |= MAIL_ERROR_POLICY;
smtpd_chat_reply(state, "%s", STR(why)); smtpd_chat_reply(state, "%s", STR(why));
@ -3994,7 +4048,6 @@ static int bdat_cmd(SMTPD_STATE *state, int argc, SMTPD_TOKEN *argv)
*/ */
done = 0; done = 0;
do { do {
int payload_err;
/* /*
* Do not skip the smtp_fread_buf() call if read_len == 0. We still * Do not skip the smtp_fread_buf() call if read_len == 0. We still
@ -4008,10 +4061,6 @@ static int bdat_cmd(SMTPD_STATE *state, int argc, SMTPD_TOKEN *argv)
smtp_fread_buf(state->buffer, read_len, state->client); smtp_fread_buf(state->buffer, read_len, state->client);
state->bdat_get_stream = vstream_memreopen( state->bdat_get_stream = vstream_memreopen(
state->bdat_get_stream, state->buffer, O_RDONLY); state->bdat_get_stream, state->buffer, O_RDONLY);
vstream_control(state->bdat_get_stream, CA_VSTREAM_CTL_EXCEPT,
CA_VSTREAM_CTL_END);
if ((payload_err = vstream_setjmp(state->bdat_get_stream)) != 0)
vstream_longjmp(state->client, payload_err);
/* /*
* Read lines from the fragment. The last line may continue in the * Read lines from the fragment. The last line may continue in the
@ -4036,6 +4085,8 @@ static int bdat_cmd(SMTPD_STATE *state, int argc, SMTPD_TOKEN *argv)
/* Skip the out_record() and VSTRING_RESET() calls below. */ /* Skip the out_record() and VSTRING_RESET() calls below. */
break; break;
} }
if (IS_BARE_LF_REPLY_REJECT(smtp_got_bare_lf))
state->err |= CLEANUP_STAT_BARE_LF;
start = vstring_str(state->bdat_get_buffer); start = vstring_str(state->bdat_get_buffer);
len = VSTRING_LEN(state->bdat_get_buffer); len = VSTRING_LEN(state->bdat_get_buffer);
if (state->err == CLEANUP_STAT_OK) { if (state->err == CLEANUP_STAT_OK) {
@ -4687,9 +4738,9 @@ static int xclient_cmd(SMTPD_STATE *state, int argc, SMTPD_TOKEN *argv)
*/ */
xclient_allowed = xclient_allowed =
namadr_list_match(xclient_hosts, state->name, state->addr); namadr_list_match(xclient_hosts, state->name, state->addr);
smtp_forbid_bare_lf = SMTPD_STAND_ALONE((state)) == 0 smtp_detect_bare_lf = (SMTPD_STAND_ALONE((state)) == 0 && bare_lf_mask
&& var_smtpd_forbid_bare_lf && !namadr_list_match(bare_lf_excl, state->name, state->addr)) ?
&& !namadr_list_match(bare_lf_excl, state->name, state->addr); bare_lf_mask : 0;
/* NOT: tls_reset() */ /* NOT: tls_reset() */
if (got_helo == 0) if (got_helo == 0)
helo_reset(state); helo_reset(state);
@ -5508,13 +5559,6 @@ static void smtpd_proto(SMTPD_STATE *state)
var_myhostname); var_myhostname);
break; break;
case SMTP_ERR_LF:
state->reason = REASON_BARE_LF;
if (vstream_setjmp(state->client) == 0)
smtpd_chat_reply(state, "521 5.5.2 %s Error: bare <LF> received",
var_myhostname);
break;
case 0: case 0:
/* /*
@ -5731,6 +5775,13 @@ static void smtpd_proto(SMTPD_STATE *state)
} }
watchdog_pat(); watchdog_pat();
smtpd_chat_query(state); smtpd_chat_query(state);
if (IS_BARE_LF_REPLY_REJECT(smtp_got_bare_lf)) {
log_whatsup(state, "reject", "bare <LF> received");
state->error_mask |= MAIL_ERROR_PROTOCOL;
smtpd_chat_reply(state, "%d 5.5.2 %s Error: bare <LF> received",
var_smtpd_forbid_bare_lf_code, var_myhostname);
break;
}
/* Safety: protect internal interfaces against malformed UTF-8. */ /* Safety: protect internal interfaces against malformed UTF-8. */
if (var_smtputf8_enable && valid_utf8_string(STR(state->buffer), if (var_smtputf8_enable && valid_utf8_string(STR(state->buffer),
LEN(state->buffer)) == 0) { LEN(state->buffer)) == 0) {
@ -6074,11 +6125,11 @@ static void smtpd_service(VSTREAM *stream, char *service, char **argv)
namadr_list_match(xforward_hosts, state.name, state.addr); namadr_list_match(xforward_hosts, state.name, state.addr);
/* /*
* Enforce strict SMTP line endings, with compatibility exclusions. * Reject or normalize bare LF, with compatibility exclusions.
*/ */
smtp_forbid_bare_lf = SMTPD_STAND_ALONE((&state)) == 0 smtp_detect_bare_lf = (SMTPD_STAND_ALONE((&state)) == 0 && bare_lf_mask
&& var_smtpd_forbid_bare_lf && !namadr_list_match(bare_lf_excl, state.name, state.addr)) ?
&& !namadr_list_match(bare_lf_excl, state.name, state.addr); bare_lf_mask : 0;
/* /*
* See if we need to turn on verbose logging for this client. * See if we need to turn on verbose logging for this client.
@ -6145,6 +6196,10 @@ static void pre_jail_init(char *unused_name, char **unused_argv)
MATCH_FLAG_RETURN MATCH_FLAG_RETURN
| match_parent_style(VAR_MYNETWORKS), | match_parent_style(VAR_MYNETWORKS),
var_smtpd_forbid_bare_lf_excl); var_smtpd_forbid_bare_lf_excl);
if ((bare_lf_mask = name_code(bare_lf_mask_table, NAME_CODE_FLAG_NONE,
var_smtpd_forbid_bare_lf)) < 0)
msg_fatal("bad parameter value: '%s = %s'",
VAR_SMTPD_FORBID_BARE_LF, var_smtpd_forbid_bare_lf);
/* /*
* Open maps before dropping privileges so we can read passwords etc. * Open maps before dropping privileges so we can read passwords etc.
@ -6440,6 +6495,7 @@ int main(int argc, char **argv)
VAR_VIRT_MAILBOX_CODE, DEF_VIRT_MAILBOX_CODE, &var_virt_mailbox_code, 0, 0, VAR_VIRT_MAILBOX_CODE, DEF_VIRT_MAILBOX_CODE, &var_virt_mailbox_code, 0, 0,
VAR_RELAY_RCPT_CODE, DEF_RELAY_RCPT_CODE, &var_relay_rcpt_code, 0, 0, VAR_RELAY_RCPT_CODE, DEF_RELAY_RCPT_CODE, &var_relay_rcpt_code, 0, 0,
VAR_PLAINTEXT_CODE, DEF_PLAINTEXT_CODE, &var_plaintext_code, 0, 0, VAR_PLAINTEXT_CODE, DEF_PLAINTEXT_CODE, &var_plaintext_code, 0, 0,
VAR_SMTPD_FORBID_BARE_LF_CODE, DEF_SMTPD_FORBID_BARE_LF_CODE, &var_smtpd_forbid_bare_lf_code, 500, 599,
VAR_SMTPD_CRATE_LIMIT, DEF_SMTPD_CRATE_LIMIT, &var_smtpd_crate_limit, 0, 0, VAR_SMTPD_CRATE_LIMIT, DEF_SMTPD_CRATE_LIMIT, &var_smtpd_crate_limit, 0, 0,
VAR_SMTPD_CCONN_LIMIT, DEF_SMTPD_CCONN_LIMIT, &var_smtpd_cconn_limit, 0, 0, VAR_SMTPD_CCONN_LIMIT, DEF_SMTPD_CCONN_LIMIT, &var_smtpd_cconn_limit, 0, 0,
VAR_SMTPD_CMAIL_LIMIT, DEF_SMTPD_CMAIL_LIMIT, &var_smtpd_cmail_limit, 0, 0, VAR_SMTPD_CMAIL_LIMIT, DEF_SMTPD_CMAIL_LIMIT, &var_smtpd_cmail_limit, 0, 0,
@ -6503,7 +6559,6 @@ int main(int argc, char **argv)
VAR_SMTPD_DELAY_OPEN, DEF_SMTPD_DELAY_OPEN, &var_smtpd_delay_open, VAR_SMTPD_DELAY_OPEN, DEF_SMTPD_DELAY_OPEN, &var_smtpd_delay_open,
VAR_SMTPD_CLIENT_PORT_LOG, DEF_SMTPD_CLIENT_PORT_LOG, &var_smtpd_client_port_log, VAR_SMTPD_CLIENT_PORT_LOG, DEF_SMTPD_CLIENT_PORT_LOG, &var_smtpd_client_port_log,
VAR_SMTPD_FORBID_UNAUTH_PIPE, DEF_SMTPD_FORBID_UNAUTH_PIPE, &var_smtpd_forbid_unauth_pipe, VAR_SMTPD_FORBID_UNAUTH_PIPE, DEF_SMTPD_FORBID_UNAUTH_PIPE, &var_smtpd_forbid_unauth_pipe,
VAR_SMTPD_FORBID_BARE_LF, DEF_SMTPD_FORBID_BARE_LF, &var_smtpd_forbid_bare_lf,
0, 0,
}; };
static const CONFIG_NBOOL_TABLE nbool_table[] = { static const CONFIG_NBOOL_TABLE nbool_table[] = {
@ -6620,6 +6675,7 @@ int main(int argc, char **argv)
VAR_SMTPD_DNS_RE_FILTER, DEF_SMTPD_DNS_RE_FILTER, &var_smtpd_dns_re_filter, 0, 0, VAR_SMTPD_DNS_RE_FILTER, DEF_SMTPD_DNS_RE_FILTER, &var_smtpd_dns_re_filter, 0, 0,
VAR_SMTPD_REJ_FTR_MAPS, DEF_SMTPD_REJ_FTR_MAPS, &var_smtpd_rej_ftr_maps, 0, 0, VAR_SMTPD_REJ_FTR_MAPS, DEF_SMTPD_REJ_FTR_MAPS, &var_smtpd_rej_ftr_maps, 0, 0,
VAR_SMTPD_FORBID_BARE_LF_EXCL, DEF_SMTPD_FORBID_BARE_LF_EXCL, &var_smtpd_forbid_bare_lf_excl, 0, 0, VAR_SMTPD_FORBID_BARE_LF_EXCL, DEF_SMTPD_FORBID_BARE_LF_EXCL, &var_smtpd_forbid_bare_lf_excl, 0, 0,
VAR_SMTPD_FORBID_BARE_LF, DEF_SMTPD_FORBID_BARE_LF, &var_smtpd_forbid_bare_lf, 1, 0,
0, 0,
}; };
static const CONFIG_RAW_TABLE raw_table[] = { static const CONFIG_RAW_TABLE raw_table[] = {

12
postfix/src/smtpd/smtpd_check.c
View File

@ -48,6 +48,11 @@
/* /*
/* char *smtpd_check_queue(state) /* char *smtpd_check_queue(state)
/* SMTPD_STATE *state; /* SMTPD_STATE *state;
/* AUXILIARY FUNCTIONS
/* void log_whatsup(state, action, text)
/* SMTPD_STATE *state;
/* const char *action;
/* const char *text;
/* DESCRIPTION /* DESCRIPTION
/* This module implements additional checks on SMTP client requests. /* This module implements additional checks on SMTP client requests.
/* A client request is validated in the context of the session state. /* A client request is validated in the context of the session state.
@ -146,6 +151,11 @@
/* The recipient address given with the RCPT TO or VRFY command. /* The recipient address given with the RCPT TO or VRFY command.
/* .IP size /* .IP size
/* The message size given with the MAIL FROM command (zero if unknown). /* The message size given with the MAIL FROM command (zero if unknown).
/* .PP
/* log_whatsup() logs "<queueid>: <action>: <protocol state>
/* from: <client-name[client-addr]>: <text>" plus the protocol
/* (SMTP or ESMTP), and if available, EHLO, MAIL FROM, or RCPT
/* TO.
/* BUGS /* BUGS
/* Policies like these should not be hard-coded in C, but should /* Policies like these should not be hard-coded in C, but should
/* be user-programmable instead. /* be user-programmable instead.
@ -987,7 +997,7 @@ void smtpd_check_init(void)
/* log_whatsup - log as much context as we have */ /* log_whatsup - log as much context as we have */
static void log_whatsup(SMTPD_STATE *state, const char *whatsup, void log_whatsup(SMTPD_STATE *state, const char *whatsup,
const char *text) const char *text)
{ {
VSTRING *buf = vstring_alloc(100); VSTRING *buf = vstring_alloc(100);

1
postfix/src/smtpd/smtpd_check.h
View File

@ -25,6 +25,7 @@ extern char *smtpd_check_etrn(SMTPD_STATE *, char *);
extern char *smtpd_check_data(SMTPD_STATE *); extern char *smtpd_check_data(SMTPD_STATE *);
extern char *smtpd_check_eod(SMTPD_STATE *); extern char *smtpd_check_eod(SMTPD_STATE *);
extern char *smtpd_check_policy(SMTPD_STATE *, char *); extern char *smtpd_check_policy(SMTPD_STATE *, char *);
extern void log_whatsup(SMTPD_STATE *, const char *, const char *);
/* LICENSE /* LICENSE
/* .ad /* .ad