port 25 ends DATA only at CRLF.CRLF: smtpd_forbid_bare_newline=normalize (port25-bare-newline)

Postfix 3.7.11 leaves its 2023 SMTP-smuggling defence off (default "no"
before 3.9, src/smtpd/smtpd.c:807), and the inbound relay's smtp/inet
listener did not turn it on: a "." line ended by a bare LF ended DATA and
what followed was read as the next transaction. The listener now sets
normalize (bare_lf_mask_table, smtpd.c:1656; the DATA loop drops such a
"." line, 3649-3652), the setting Postfix recommends and 3.9's default.
The submission ports keep the default (own-mta-builds, section 5).

Tests: e2e inbound_bare_newline_is_one_message sends the smuggling
sequence over raw SMTP (net/smtp's DotWriter would rewrite the bare LF)
and finds one message at the upstream with the smuggled part inside;
port25 config check asserts the parameter on smtp/inet. On the server:
make e2e exit 0 (511 s), go vet + go test 27 packages ok.

Docs: CHANGELOG [Unreleased] Security, security.md, architecture.md,
guide.md; roadmap: port25-bare-newline, base-trixie and
panel-dkim-signing agreed by the owner in this order.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/main_test.go

@@ -386,6 +386,9 @@ func TestE2E(t *testing.T) {
 	run("inbound_relay_delivers_and_refuses", func(t *testing.T) {
 		testInboundRelay(t, sc)
 	})
+	run("inbound_bare_newline_is_one_message", func(t *testing.T) {
+		testInboundBareNewline(t, sc)
+	})
 }
 
 // trimZoneSuffix strips the "e2e.test" suffix a fully-qualified DKIM record

test/e2e/port25_client.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net"
 	"net/smtp"
+	"net/textproto"
 	"time"
 )
 
@@ -80,3 +81,53 @@ func waitForPort25Ready(timeout time.Duration) error {
 		return true, nil
 	})
 }
+
+// deliverPort25Raw is deliverPort25 with the DATA bytes written as they
+// stand. net/smtp's data writer would turn a bare LF into CRLF and stuff a
+// lone "." (net/textproto, DotWriter), which is the very input this is for.
+// It returns an error for a reply other than the one each step expects.
+func deliverPort25Raw(from, to string, data []byte) error {
+	conn, err := net.DialTimeout("tcp", port25Addr, 10*time.Second)
+	if err != nil {
+		return fmt.Errorf("dial %s: %w", port25Addr, err)
+	}
+	defer conn.Close()
+	_ = conn.SetDeadline(time.Now().Add(60 * time.Second))
+	tp := textproto.NewConn(conn)
+	expect := func(code int, after string) error {
+		if _, _, err := tp.ReadResponse(code); err != nil {
+			return fmt.Errorf("after %s: %w", after, err)
+		}
+		return nil
+	}
+	if err := expect(220, "connect"); err != nil {
+		return err
+	}
+	for _, step := range []struct {
+		cmd  string
+		code int
+	}{
+		{"HELO mx.stranger.e2e.test", 250},
+		{"MAIL FROM:<" + from + ">", 250},
+		{"RCPT TO:<" + to + ">", 250},
+		{"DATA", 354},
+	} {
+		if err := tp.PrintfLine("%s", step.cmd); err != nil {
+			return fmt.Errorf("%s: %w", step.cmd, err)
+		}
+		if err := expect(step.code, step.cmd); err != nil {
+			return err
+		}
+	}
+	if _, err := tp.W.Write(data); err != nil {
+		return fmt.Errorf("DATA content: %w", err)
+	}
+	if err := tp.W.Flush(); err != nil {
+		return fmt.Errorf("DATA content: %w", err)
+	}
+	if err := expect(250, "end of data"); err != nil {
+		return err
+	}
+	_ = tp.PrintfLine("QUIT")
+	return nil
+}

test/e2e/port25_config_check.go

@@ -51,6 +51,9 @@ var port25Cases = []port25Case{
 			// The log tailer tells this listener's refusals from the
 			// submission ports' by the name they are logged under.
 			{param: "syslog_name", contains: "postfix/inbound", wantExact: true},
+			// The SMTP-smuggling defence, off by default on this Postfix
+			// (own-mta-builds, § 5); testInboundBareNewline drives it.
+			{param: "smtpd_forbid_bare_newline", contains: "normalize", wantExact: true},
 			// No antispam milter configured: the inbound journal milter
 			// alone. The submission chain (strict OpenDKIM + journal-milter)
 			// must not reach inbound mail.

test/e2e/port25_features_test.go

@@ -6,6 +6,8 @@ import (
 	"encoding/base64"
 	"fmt"
 	"net/url"
+	"os"
+	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
@@ -456,3 +458,58 @@ func testInboundRelay(t *testing.T, sc *scenario) {
 		t.Fatalf("deny_domain.map after removing %s:\n%s", spammer, got)
 	}
 }
+
+// testInboundBareNewline: port 25 ends DATA only at the standard
+// <CR><LF>.<CR><LF>. A "." line that a bare <LF> precedes or ends - the SMTP
+// smuggling sequence, with a second transaction's commands behind it - is
+// body, and the one message delivered carries all of it; nothing is read as
+// a second transaction (smtpd_forbid_bare_newline=normalize on smtp/inet,
+// build/postfix-config.sh; Postfix 3.7.11, src/smtpd/smtpd.c:3649-3652).
+// Runs after testInboundRelay, whose domain, upstream and recipient it uses.
+func testInboundBareNewline(t *testing.T, sc *scenario) {
+	token := uniqueToken("inbound-bare")
+	smuggled := uniqueToken("smuggled")
+	data := "From: someone@stranger.e2e.test\r\nTo: " + inboundRecipient +
+		"\r\nSubject: e2e " + token + "\r\nDate: " + time.Now().UTC().Format(time.RFC1123Z) +
+		"\r\n\r\nthe first part\n.\n" +
+		"MAIL FROM:<someone@stranger.e2e.test>\r\nRCPT TO:<" + inboundRecipient + ">\r\nDATA\r\n" +
+		"Subject: e2e " + smuggled + "\r\n\r\nthe part a smuggler would send\r\n.\r\n"
+	if err := deliverPort25Raw("someone@stranger.e2e.test", inboundRecipient, []byte(data)); err != nil {
+		t.Fatalf("port 25 did not take the message with a bare-newline \".\" inside: %v\n%s", err, mailLogTail(h, "postfix/"))
+	}
+	raw, err := findSinkMessage(h.stageDir, token, 30*time.Second)
+	if err != nil {
+		t.Fatalf("the message never reached the upstream: %v\n%s", err, mailLogTail(h, "postfix/"))
+	}
+	if !bytes.Contains(raw, []byte(smuggled)) {
+		t.Fatalf("the message was cut at the bare-newline \".\": what followed it is not in the delivered message\n%s", raw)
+	}
+	// A second transaction, had Postfix read one, would be delivered right
+	// behind the first: give it the time and count the files that carry the
+	// smuggled token.
+	time.Sleep(3 * time.Second)
+	if n := sinkMessagesWith(t, h.stageDir, smuggled); n != 1 {
+		t.Fatalf("%d messages at the upstream carry the smuggled part, want 1\n%s", n, mailLogTail(h, "postfix/"))
+	}
+}
+
+// sinkMessagesWith counts the sink's dumped messages that contain token.
+func sinkMessagesWith(t *testing.T, stageDir, token string) int {
+	t.Helper()
+	dir := filepath.Join(stageDir, "mail-stage")
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		t.Fatalf("read %s: %v", dir, err)
+	}
+	n := 0
+	for _, e := range entries {
+		if e.IsDir() {
+			continue
+		}
+		b, err := os.ReadFile(filepath.Join(dir, e.Name()))
+		if err == nil && bytes.Contains(b, []byte(token)) {
+			n++
+		}
+	}
+	return n
+}