port 25 ends DATA only at CRLF.CRLF: smtpd_forbid_bare_newline=normalize (port25-bare-newline)

Postfix 3.7.11 leaves its 2023 SMTP-smuggling defence off (default "no"
before 3.9, src/smtpd/smtpd.c:807), and the inbound relay's smtp/inet
listener did not turn it on: a "." line ended by a bare LF ended DATA and
what followed was read as the next transaction. The listener now sets
normalize (bare_lf_mask_table, smtpd.c:1656; the DATA loop drops such a
"." line, 3649-3652), the setting Postfix recommends and 3.9's default.
The submission ports keep the default (own-mta-builds, section 5).

Tests: e2e inbound_bare_newline_is_one_message sends the smuggling
sequence over raw SMTP (net/smtp's DotWriter would rewrite the bare LF)
and finds one message at the upstream with the smuggled part inside;
port25 config check asserts the parameter on smtp/inet. On the server:
make e2e exit 0 (511 s), go vet + go test 27 packages ok.

Docs: CHANGELOG [Unreleased] Security, security.md, architecture.md,
guide.md; roadmap: port25-bare-newline, base-trixie and
panel-dkim-signing agreed by the owner in this order.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/port25_client.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net"
 	"net/smtp"
+	"net/textproto"
 	"time"
 )
 
@@ -80,3 +81,53 @@ func waitForPort25Ready(timeout time.Duration) error {
 		return true, nil
 	})
 }
+
+// deliverPort25Raw is deliverPort25 with the DATA bytes written as they
+// stand. net/smtp's data writer would turn a bare LF into CRLF and stuff a
+// lone "." (net/textproto, DotWriter), which is the very input this is for.
+// It returns an error for a reply other than the one each step expects.
+func deliverPort25Raw(from, to string, data []byte) error {
+	conn, err := net.DialTimeout("tcp", port25Addr, 10*time.Second)
+	if err != nil {
+		return fmt.Errorf("dial %s: %w", port25Addr, err)
+	}
+	defer conn.Close()
+	_ = conn.SetDeadline(time.Now().Add(60 * time.Second))
+	tp := textproto.NewConn(conn)
+	expect := func(code int, after string) error {
+		if _, _, err := tp.ReadResponse(code); err != nil {
+			return fmt.Errorf("after %s: %w", after, err)
+		}
+		return nil
+	}
+	if err := expect(220, "connect"); err != nil {
+		return err
+	}
+	for _, step := range []struct {
+		cmd  string
+		code int
+	}{
+		{"HELO mx.stranger.e2e.test", 250},
+		{"MAIL FROM:<" + from + ">", 250},
+		{"RCPT TO:<" + to + ">", 250},
+		{"DATA", 354},
+	} {
+		if err := tp.PrintfLine("%s", step.cmd); err != nil {
+			return fmt.Errorf("%s: %w", step.cmd, err)
+		}
+		if err := expect(step.code, step.cmd); err != nil {
+			return err
+		}
+	}
+	if _, err := tp.W.Write(data); err != nil {
+		return fmt.Errorf("DATA content: %w", err)
+	}
+	if err := tp.W.Flush(); err != nil {
+		return fmt.Errorf("DATA content: %w", err)
+	}
+	if err := expect(250, "end of data"); err != nil {
+		return err
+	}
+	_ = tp.PrintfLine("QUIT")
+	return nil
+}