port 25 ends DATA only at CRLF.CRLF: smtpd_forbid_bare_newline=normalize (port25-bare-newline)
Postfix 3.7.11 leaves its 2023 SMTP-smuggling defence off (default "no" before 3.9, src/smtpd/smtpd.c:807), and the inbound relay's smtp/inet listener did not turn it on: a "." line ended by a bare LF ended DATA and what followed was read as the next transaction. The listener now sets normalize (bare_lf_mask_table, smtpd.c:1656; the DATA loop drops such a "." line, 3649-3652), the setting Postfix recommends and 3.9's default. The submission ports keep the default (own-mta-builds, section 5). Tests: e2e inbound_bare_newline_is_one_message sends the smuggling sequence over raw SMTP (net/smtp's DotWriter would rewrite the bare LF) and finds one message at the upstream with the smuggled part inside; port25 config check asserts the parameter on smtp/inet. On the server: make e2e exit 0 (511 s), go vet + go test 27 packages ok. Docs: CHANGELOG [Unreleased] Security, security.md, architecture.md, guide.md; roadmap: port25-bare-newline, base-trixie and panel-dkim-signing agreed by the owner in this order. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
@@ -189,6 +189,11 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
|
||||
panel's sender check (§ Panel roles).
|
||||
- **Level-1 rate limit** — `smtpd_client_message_rate_limit` /
|
||||
`anvil_rate_time_unit` from `RATE_LIMIT_*` env vars; independent of milter.
|
||||
- **Port 25 ends DATA only at `<CR><LF>.<CR><LF>`** —
|
||||
`smtpd_forbid_bare_newline=normalize` on the `smtp/inet` listener (Postfix
|
||||
3.7.11, `src/smtpd/smtpd.c`, the DATA loop at 3649: a `.` line next to a
|
||||
bare `<LF>` is dropped, not taken as the end); a bare `<LF>` elsewhere is
|
||||
read as `<CR><LF>`. The submission ports keep Postfix's default.
|
||||
- **Chroot disabled** for all services (DNS/TLS inside container).
|
||||
- **TLS certs** — read-only mount at `TLS_CERT_FILE` / `TLS_KEY_FILE`, copied
|
||||
at start into `/etc/postfix/tls-internal`, owned by root and `0600` as
|
||||
|
||||
+5
-1
@@ -1010,7 +1010,11 @@ SelfPost never stores the message locally.
|
||||
container. Until then there is no inbound-relay `smtp inet` listener, no
|
||||
*Inbound* group in the menu, and `/inbound/…` is 404. (Port 25 can still
|
||||
listen when only `DMARC_REPORTS_ENABLE=true` — see [DMARC
|
||||
reports](#dmarc-reports).) Outbound 465/587 is unchanged.
|
||||
reports](#dmarc-reports).) Outbound 465/587 is unchanged. Port 25 ends a
|
||||
message only at the standard `<CR><LF>.<CR><LF>` (the SMTP-smuggling
|
||||
defence, since `2.6.1`); a sending server that ends DATA with a bare
|
||||
newline waits for a reply that does not come, and there is no allow-list
|
||||
for such a sender.
|
||||
|
||||
**Panel** (`/inbound/domains`): the global role adds and deletes domains. On a
|
||||
domain's page, set the upstream host/port and TLS to that hop (opportunistic /
|
||||
|
||||
+5
-5
@@ -42,9 +42,9 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
|
||||
| settings-save-row | Server › Settings: the Save button no longer stands alone under a long right column | agreed (2026-10-15) | — | — |
|
||||
| dns-record-collapse | A DNS record that is right is shown folded: its name and its tag, the values on request | agreed (2026-10-15) | — | — |
|
||||
| own-mta-builds | Analysis: build Postfix and OpenDKIM ourselves, patched, instead of Debian's packages | analysed 2026-10-15: no own builds; three rows proposed instead | — | [own-mta-builds-2026-10-15.md](own-mta-builds-2026-10-15.md) |
|
||||
| port25-bare-newline | The inbound relay's port 25 refuses bare newlines in DATA (`smtpd_forbid_bare_newline=normalize`) | candidate (2026-10-15, from own-mta-builds; recommended now, PATCH) | — | — |
|
||||
| base-trixie | The image's base from Debian bookworm (LTS since 2026-07-12) to trixie: Postfix 3.10 with the 2026 security batches | candidate (2026-10-15, from own-mta-builds; recommended next, MINOR) | — | — |
|
||||
| panel-dkim-signing | DKIM signing in the panel's own milter; OpenDKIM, the syslog relay and the parser port removed | candidate (2026-10-15, from own-mta-builds; recommended after base-trixie, MINOR) | — | — |
|
||||
| port25-bare-newline | The inbound relay's port 25 refuses bare newlines in DATA (`smtpd_forbid_bare_newline=normalize`) | agreed (2026-10-15; first of the three, PATCH) | — | — |
|
||||
| base-trixie | The image's base from Debian bookworm (LTS since 2026-07-12) to trixie: Postfix 3.10 with the 2026 security batches | agreed (2026-10-15; after port25-bare-newline, MINOR) | — | — |
|
||||
| panel-dkim-signing | DKIM signing in the panel's own milter; OpenDKIM, the syslog relay and the parser port removed | agreed (2026-10-15; after base-trixie, MINOR) | — | — |
|
||||
| phone-desktop-mode | A phone browser in "desktop site" mode gets the phone navigation | agreed (2026-10-13: after stages 1 and 2 of audit-2026-10-12) | — | — |
|
||||
| from-header-binding | Hold a message's `From:` header against the application that sends it | shipped `2.4.0` | 9/9 | [plans/from-header-binding.md](plans/from-header-binding.md) |
|
||||
| panel-redesign | Panel redesign (accepted mockups, design contract) | shipped `2.0.0` | 27/27 | [plans/panel-redesign.md](plans/panel-redesign.md) |
|
||||
@@ -784,8 +784,8 @@ is answered by three rows instead, in this order:
|
||||
Postfix 3.7.11 lacks the three 2026 security batches, which carry no CVE
|
||||
ids and so will not come), and
|
||||
[panel-dkim-signing](#panel-dkim-signing) (signing in the panel's own
|
||||
milter; OpenDKIM, the syslog relay and the parser port go). Each needs
|
||||
the owner's OK.
|
||||
milter; OpenDKIM, the syslog relay and the parser port go). The owner
|
||||
agreed to the three and their order on 2026-10-15.
|
||||
|
||||
## port25-bare-newline
|
||||
|
||||
|
||||
+8
-1
@@ -262,7 +262,14 @@ operator can act on it.
|
||||
is never accepted with nowhere to send it. Prefer recipient mode `list` to
|
||||
refuse unknown addresses at RCPT (no backscatter). OpenDKIM is not attached
|
||||
on inbound. An optional antispam milter is inbound-only; default action is
|
||||
fail-open (`accept`).
|
||||
fail-open (`accept`). Since `2.6.1` the listener ends DATA only at the
|
||||
standard `<CR><LF>.<CR><LF>` (`smtpd_forbid_bare_newline=normalize`, the
|
||||
2023 SMTP-smuggling defence, which Postfix 3.7 leaves off by default): a
|
||||
`.` line next to a bare newline is body, and what a smuggler would put
|
||||
behind it is delivered as part of the one message, not read as a second
|
||||
transaction. The submission ports keep the default - there a smuggled
|
||||
transaction is still the authenticated session's, under its sender
|
||||
bindings and milters ([own-mta-builds](own-mta-builds-2026-10-15.md) § 5).
|
||||
- **The panel's milters judge every message of a connection.** Postfix
|
||||
introduces a client to a milter once per connection, and the milter library
|
||||
replaces the milter's session after any reply that is not "continue". Until
|
||||
|
||||
Reference in New Issue
Block a user