mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 8 Packages Projects Releases Wiki Activity

docs: the upstream's Required TLS checks no certificate (audit M7)

Browse Source 
Security audit 2026-10-17, finding M7 (low), stage 6; Help's mockup is
c09368c. postfix/inbound.go writes "encrypt" for Required, and Postfix
verifies no certificate at that level: a domain user who chooses it gets
privacy against passive observers only. The guide § Inbound relay and Help
(word for word with the mockup) say so. Offering "secure" with the
upstream's name is a choice for domain users and hours of work: it goes on
the roadmap as a proposal, not into this plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-17 22:34:29 +03:00
co-authored by Claude Opus 5.5
parent c09368c544
commit 820b1bb968
4 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/guide.md
+4 -1
View File
@@ -1225,7 +1225,10 @@ for such a sender.
**Panel** (`/inbound/domains`): the global role adds and deletes domains. On a
domain's page, set the upstream host/port and TLS to that hop (opportunistic /
required / off), and choose recipients. An upstream has one TLS mode: Postfix
required / off), and choose recipients. *Required* is Postfix's `encrypt`
level: the hop is encrypted, but the upstream's certificate is not checked,
so it guards against someone who listens on the way, not against one who
answers in the upstream's place. An upstream has one TLS mode: Postfix
keeps the TLS policy per next hop, not per domain, so the mode saved for one
domain is the mode of every domain forwarded to the same host and port, and
they are changed with it; a *domain* user who does not manage all of them is
docs/security-audit-2026-10-17.md
+2 -2
View File
@@ -847,8 +847,8 @@ the argument.
### Stage 6 — the rest, and what to accept (~3 h)
- [ ] **M7.** guide: upstream `encrypt` checks no certificate. — **Sonnet**,
0.25 h. (Offering `secure` is hours and a `domain`-user-facing choice;
- [x] **M7.** guide: upstream `encrypt` checks no certificate. — **Sonnet**,
0.25 h. *Done 2026-10-17:* guide and Help. (Offering `secure` is hours and a `domain`-user-facing choice;
propose it on the roadmap, not here.)
- [ ] **A6, A7, A10, W7, M6, M8** and the README note — half an hour each,
or the wording change named under each. — **Sonnet**, 2 h.