mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 21 Packages Projects Releases Wiki Activity

port 25 ends DATA only at CRLF.CRLF: smtpd_forbid_bare_newline=normalize (port25-bare-newline)

Browse Source 
Postfix 3.7.11 leaves its 2023 SMTP-smuggling defence off (default "no"
before 3.9, src/smtpd/smtpd.c:807), and the inbound relay's smtp/inet
listener did not turn it on: a "." line ended by a bare LF ended DATA and
what followed was read as the next transaction. The listener now sets
normalize (bare_lf_mask_table, smtpd.c:1656; the DATA loop drops such a
"." line, 3649-3652), the setting Postfix recommends and 3.9's default.
The submission ports keep the default (own-mta-builds, section 5).

Tests: e2e inbound_bare_newline_is_one_message sends the smuggling
sequence over raw SMTP (net/smtp's DotWriter would rewrite the bare LF)
and finds one message at the upstream with the smuggled part inside;
port25 config check asserts the parameter on smtp/inet. On the server:
make e2e exit 0 (511 s), go vet + go test 27 packages ok.

Docs: CHANGELOG [Unreleased] Security, security.md, architecture.md,
guide.md; roadmap: port25-bare-newline, base-trixie and
panel-dkim-signing agreed by the owner in this order.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-15 17:24:29 +03:00
co-authored by Claude Opus 5.5
parent 2c8aec79b4
commit aaa94120be
10 changed files with 165 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build/postfix-config.sh
+13
View File
@@ -643,7 +643,20 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
# program name. Only smtpd carries it: cleanup and the rest are other
# services and log as postfix/.)
postconf -M "smtp/inet=smtp inet n - n - - smtpd"
# smtpd_forbid_bare_newline: the 2023 SMTP-smuggling defence, which this
# Postfix leaves off. normalize takes a bare <LF> as a line end but ends
# DATA only at the standard <CR><LF>.<CR><LF>: a "." line that a bare
# <LF> precedes or ends is dropped, not taken as the end of the message
# (Postfix 3.7.11, src/smtpd/smtpd.c:807, the default "no" for Postfix
# < 3.9; :1656, bare_lf_mask_table, normalize = BARE_LF_FLAG_WANT_STD_EOD;
# :3649-3652, the DATA loop; RELEASE_NOTES, "Major changes with Postfix
# 3.8.5, 3.7.10": normalize is the recommended setting and 3.9's
# default). Its exclusions default to $mynetworks, loopback only here
# (above), so no client is spared. The submission ports keep the
# default: their smuggled transaction would still be the authenticated
# session's, under its bindings and milters (own-mta-builds, § 5).
postconf -P \
"smtp/inet/smtpd_forbid_bare_newline=normalize" \
"smtp/inet/syslog_name=postfix/inbound" \
"smtp/inet/smtpd_sasl_auth_enable=no" \
"smtp/inet/smtpd_tls_auth_only=no" \