release: 2.6.1: port 25 ends DATA only at CRLF.CRLF

Cut without asking, as the owner said on 2026-10-15. The inbound relay's smtp/inet listener sets smtpd_forbid_bare_newline=normalize, the SMTP-smuggling defence Postfix 3.7.11 leaves off (aaa9412, port25-bare-newline, the first of the three rows from own-mta-builds). Rolled out to the test server as 2.6.0-post.aaa9412 (the same code): the container healthy, every program RUNNING; the server runs the inbound relay, and postconf -P shows smtp/inet/smtpd_forbid_bare_newline = normalize next to syslog_name postfix/inbound; no warning or fatal in docker logs. No migration, schema 11. CHANGELOG cut; pin 2.6.1 in deploy/docker-compose.yml, README, guide (and its sample restore message); development.md "from pin" and the row; roadmap row shipped and the recommended order. No tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
port 25 ends DATA only at CRLF.CRLF: smtpd_forbid_bare_newline=normalize (port25-bare-newline)
2026-10-15 17:30:33 +03:00 · 2026-10-15 17:24:29 +03:00
13 changed files with 184 additions and 17 deletions
@@ -5,6 +5,27 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version

 ## [Unreleased]

+## [2.6.1] - 2026-10-15
+
+The inbound relay's port 25 ends a message only at the standard
+`<CR><LF>.<CR><LF>`: the SMTP-smuggling defence Postfix 3.7 leaves off.
+No migration; schema 11.
+
+### Security
+
+- **Port 25 could be made to read a second transaction out of a message's
+  body.** Postfix 3.7 leaves its 2023 SMTP-smuggling defence off
+  (`smtpd_forbid_bare_newline`, default `no` before 3.9), and the inbound
+  relay's listener did not turn it on: a `.` line ended by a bare newline
+  ended DATA, and what followed was read as the next transaction's commands.
+  The listener now sets `normalize` - the setting Postfix recommends and 3.9
+  made the default: DATA ends only at the standard `<CR><LF>.<CR><LF>`, a
+  bare newline elsewhere is read as a line end. Found while reading for
+  [own-mta-builds](docs/own-mta-builds-2026-10-15.md) (§ 5); `test/e2e`
+  sends the sequence and finds one message at the upstream with all of it
+  inside. Only installations with `INBOUND_RELAY_ENABLE=true` or
+  `DMARC_REPORTS_ENABLE=true` have the listener.
+
 ## [2.6.0] - 2026-10-15

 Stage 5 of the 2026-10-12 audit: the image and Postfix. The supervisor
@@ -112,8 +112,8 @@ outbound mail will not reach the real internet without DNS, PTR, and port 25.
 > local image and pulls nothing:
 >
 > ```sh
-> docker build -f build/Dockerfile --build-arg VERSION=2.6.0 \
->   -t ghcr.io/mixeme/selfpost:2.6.0 .
+> docker build -f build/Dockerfile --build-arg VERSION=2.6.1 \
+>   -t ghcr.io/mixeme/selfpost:2.6.1 .
 > ```

 ```sh
@@ -122,7 +122,7 @@ docker run --rm -d --name selfpost-try \
  -e SELFPOST_HOSTNAME=mail.local.test \
  -e PANEL_COOKIE_SECURE=false \
  -v selfpost-try-data:/data \
-  ghcr.io/mixeme/selfpost:2.6.0
+  ghcr.io/mixeme/selfpost:2.6.1
 ```

 **Get the setup URL** (pick one):
@@ -643,7 +643,20 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 	# program name. Only smtpd carries it: cleanup and the rest are other
 	# services and log as postfix/.)
 	postconf -M "smtp/inet=smtp inet n - n - - smtpd"
+	# smtpd_forbid_bare_newline: the 2023 SMTP-smuggling defence, which this
+	# Postfix leaves off. normalize takes a bare <LF> as a line end but ends
+	# DATA only at the standard <CR><LF>.<CR><LF>: a "." line that a bare
+	# <LF> precedes or ends is dropped, not taken as the end of the message
+	# (Postfix 3.7.11, src/smtpd/smtpd.c:807, the default "no" for Postfix
+	# < 3.9; :1656, bare_lf_mask_table, normalize = BARE_LF_FLAG_WANT_STD_EOD;
+	# :3649-3652, the DATA loop; RELEASE_NOTES, "Major changes with Postfix
+	# 3.8.5, 3.7.10": normalize is the recommended setting and 3.9's
+	# default). Its exclusions default to $mynetworks, loopback only here
+	# (above), so no client is spared. The submission ports keep the
+	# default: their smuggled transaction would still be the authenticated
+	# session's, under its bindings and milters (own-mta-builds, § 5).
 	postconf -P \
+		"smtp/inet/smtpd_forbid_bare_newline=normalize" \
 		"smtp/inet/syslog_name=postfix/inbound" \
 		"smtp/inet/smtpd_sasl_auth_enable=no" \
 		"smtp/inet/smtpd_tls_auth_only=no" \
@@ -23,7 +23,7 @@

 services:
  selfpost:
-    image: ghcr.io/mixeme/selfpost:2.6.0
+    image: ghcr.io/mixeme/selfpost:2.6.1
    restart: unless-stopped
    environment:
      SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}"
@@ -189,6 +189,11 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
  panel's sender check (§ Panel roles).
 - **Level-1 rate limit** — `smtpd_client_message_rate_limit` /
  `anvil_rate_time_unit` from `RATE_LIMIT_*` env vars; independent of milter.
+- **Port 25 ends DATA only at `<CR><LF>.<CR><LF>`** —
+  `smtpd_forbid_bare_newline=normalize` on the `smtp/inet` listener (Postfix
+  3.7.11, `src/smtpd/smtpd.c`, the DATA loop at 3649: a `.` line next to a
+  bare `<LF>` is dropped, not taken as the end); a bare `<LF>` elsewhere is
+  read as `<CR><LF>`. The submission ports keep Postfix's default.
 - **Chroot disabled** for all services (DNS/TLS inside container).
 - **TLS certs** — read-only mount at `TLS_CERT_FILE` / `TLS_KEY_FILE`, copied
  at start into `/etc/postfix/tls-internal`, owned by root and `0600` as
@@ -107,7 +107,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 2. Git tag `vX.Y.Z` and publish the GitHub Release only on explicit request (see
   [§ Release image](#release-image)).

-**Planned version cuts** (from pin `2.6.0`; adjust if semver changes mid-track):
+**Planned version cuts** (from pin `2.6.1`; adjust if semver changes mid-track):

 | Stage | ID | Cut |
 |---|---|---|
@@ -137,6 +137,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 | 24 | audit-2026-10-12 stage 3: persistence and restore | `2.5.3` |
 | 25 | audit-2026-10-12 stage 4: panel behaviour | `2.5.4` |
 | 26 | audit-2026-10-12 stage 5: image and Postfix hardening | `2.6.0` |
+| 27 | port25-bare-newline | `2.6.1` (PATCH) |

 Docs-only prep (checklists in plans, no product code) uses the same per-step
 commit rule but **no** version cut until the next product stage ships.
@@ -190,14 +190,14 @@ cat ./data/setup-token
 #### Fixed image tag

 `deploy/docker-compose.yml` pins an explicit version (`ghcr.io/mixeme/selfpost:X.Y.Z`),
-deliberately never `:latest`. The current pin is `2.6.0`. **No 2.x image is
+deliberately never `:latest`. The current pin is `2.6.1`. **No 2.x image is
 published on ghcr.io yet** (the newest there is `1.3.0`); until one is, build
 it from the checkout under the pinned name, and Compose uses the local image
 instead of pulling:

 ```sh
-docker build -f build/Dockerfile --build-arg VERSION=2.6.0 \
-  -t ghcr.io/mixeme/selfpost:2.6.0 .
+docker build -f build/Dockerfile --build-arg VERSION=2.6.1 \
+  -t ghcr.io/mixeme/selfpost:2.6.1 .
 ```

 `VERSION` must equal the tag: it is the version the backup check compares
@@ -860,7 +860,7 @@ A version mismatch at step 5 refuses to start and leaves `/data` untouched —
 the panel exits with a message naming the tag to use, e.g.:

 ```
-backup: this backup was created by SelfPost 2.5.4 but this image is 2.6.0 — restore into the matching image (selfpost:2.5.4)
+backup: this backup was created by SelfPost 2.6.0 but this image is 2.6.1 — restore into the matching image (selfpost:2.6.0)
 ```

 Fix the tag in `docker-compose.yml` (build that tag as under [Fixed image
@@ -1010,7 +1010,11 @@ SelfPost never stores the message locally.
 container. Until then there is no inbound-relay `smtp inet` listener, no
 *Inbound* group in the menu, and `/inbound/…` is 404. (Port 25 can still
 listen when only `DMARC_REPORTS_ENABLE=true` — see [DMARC
-reports](#dmarc-reports).) Outbound 465/587 is unchanged.
+reports](#dmarc-reports).) Outbound 465/587 is unchanged. Port 25 ends a
+message only at the standard `<CR><LF>.<CR><LF>` (the SMTP-smuggling
+defence, since `2.6.1`); a sending server that ends DATA with a bare
+newline waits for a reply that does not come, and there is no allow-list
+for such a sender.

 **Panel** (`/inbound/domains`): the global role adds and deletes domains. On a
 domain's page, set the upstream host/port and TLS to that hop (opportunistic /
@@ -42,9 +42,9 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 | settings-save-row | Server › Settings: the Save button no longer stands alone under a long right column | agreed (2026-10-15) | — | — |
 | dns-record-collapse | A DNS record that is right is shown folded: its name and its tag, the values on request | agreed (2026-10-15) | — | — |
 | own-mta-builds | Analysis: build Postfix and OpenDKIM ourselves, patched, instead of Debian's packages | analysed 2026-10-15: no own builds; three rows proposed instead | — | [own-mta-builds-2026-10-15.md](own-mta-builds-2026-10-15.md) |
-| port25-bare-newline | The inbound relay's port 25 refuses bare newlines in DATA (`smtpd_forbid_bare_newline=normalize`) | candidate (2026-10-15, from own-mta-builds; recommended now, PATCH) | — | — |
-| base-trixie | The image's base from Debian bookworm (LTS since 2026-07-12) to trixie: Postfix 3.10 with the 2026 security batches | candidate (2026-10-15, from own-mta-builds; recommended next, MINOR) | — | — |
-| panel-dkim-signing | DKIM signing in the panel's own milter; OpenDKIM, the syslog relay and the parser port removed | candidate (2026-10-15, from own-mta-builds; recommended after base-trixie, MINOR) | — | — |
+| port25-bare-newline | The inbound relay's port 25 refuses bare newlines in DATA (`smtpd_forbid_bare_newline=normalize`) | shipped `2.6.1` | — | — |
+| base-trixie | The image's base from Debian bookworm (LTS since 2026-07-12) to trixie: Postfix 3.10 with the 2026 security batches | agreed (2026-10-15; after port25-bare-newline, MINOR) | — | — |
+| panel-dkim-signing | DKIM signing in the panel's own milter; OpenDKIM, the syslog relay and the parser port removed | agreed (2026-10-15; after base-trixie, MINOR) | — | — |
 | phone-desktop-mode | A phone browser in "desktop site" mode gets the phone navigation | agreed (2026-10-13: after stages 1 and 2 of audit-2026-10-12) | — | — |
 | from-header-binding | Hold a message's `From:` header against the application that sends it | shipped `2.4.0` | 9/9 | [plans/from-header-binding.md](plans/from-header-binding.md) |
 | panel-redesign | Panel redesign (accepted mockups, design contract) | shipped `2.0.0` | 27/27 | [plans/panel-redesign.md](plans/panel-redesign.md) |
@@ -61,7 +61,9 @@ shipped as `2.2.0` the same day, **panel-notifications** as `2.3.0` and
 stages 1 and 2 as `2.5.0` the same day, stage 2b as `2.5.1`, stage 2c as
 `2.5.2` (2026-10-15), and stages 3, 4 and 5 as `2.5.3`, `2.5.4` and
 `2.6.0` the same day; stage 6 (documents and tests, no cut) closed the
-audit. What is agreed after it is marked so in the index; every other
+audit. Of the three rows from [own-mta-builds](#own-mta-builds),
+**port25-bare-newline** shipped as `2.6.1` the same day; base-trixie and
+panel-dkim-signing follow in that order. What is agreed after it is marked so in the index; every other
 remaining item is a candidate. panel-docs shipped in
 [CHANGELOG.md](../CHANGELOG.md) `[1.8.0]`; dmarc-reports in `[1.7.0]`
 (its ingest path first ran in `2.0.0` and was reviewed on 2026-10-11, see
@@ -784,8 +786,8 @@ is answered by three rows instead, in this order:
 Postfix 3.7.11 lacks the three 2026 security batches, which carry no CVE
 ids and so will not come), and
 [panel-dkim-signing](#panel-dkim-signing) (signing in the panel's own
-milter; OpenDKIM, the syslog relay and the parser port go). Each needs
-the owner's OK.
+milter; OpenDKIM, the syslog relay and the parser port go). The owner
+agreed to the three and their order on 2026-10-15.

 ## port25-bare-newline

@@ -262,7 +262,14 @@ operator can act on it.
  is never accepted with nowhere to send it. Prefer recipient mode `list` to
  refuse unknown addresses at RCPT (no backscatter). OpenDKIM is not attached
  on inbound. An optional antispam milter is inbound-only; default action is
-  fail-open (`accept`).
+  fail-open (`accept`). Since `2.6.1` the listener ends DATA only at the
+  standard `<CR><LF>.<CR><LF>` (`smtpd_forbid_bare_newline=normalize`, the
+  2023 SMTP-smuggling defence, which Postfix 3.7 leaves off by default): a
+  `.` line next to a bare newline is body, and what a smuggler would put
+  behind it is delivered as part of the one message, not read as a second
+  transaction. The submission ports keep the default - there a smuggled
+  transaction is still the authenticated session's, under its sender
+  bindings and milters ([own-mta-builds](own-mta-builds-2026-10-15.md) § 5).
 - **The panel's milters judge every message of a connection.** Postfix
  introduces a client to a milter once per connection, and the milter library
  replaces the milter's session after any reply that is not "continue". Until
@@ -386,6 +386,9 @@ func TestE2E(t *testing.T) {
 	run("inbound_relay_delivers_and_refuses", func(t *testing.T) {
 		testInboundRelay(t, sc)
 	})
+	run("inbound_bare_newline_is_one_message", func(t *testing.T) {
+		testInboundBareNewline(t, sc)
+	})
 }

 // trimZoneSuffix strips the "e2e.test" suffix a fully-qualified DKIM record
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net"
 	"net/smtp"
+	"net/textproto"
 	"time"
 )

@@ -80,3 +81,53 @@ func waitForPort25Ready(timeout time.Duration) error {
 		return true, nil
 	})
 }
+
+// deliverPort25Raw is deliverPort25 with the DATA bytes written as they
+// stand. net/smtp's data writer would turn a bare LF into CRLF and stuff a
+// lone "." (net/textproto, DotWriter), which is the very input this is for.
+// It returns an error for a reply other than the one each step expects.
+func deliverPort25Raw(from, to string, data []byte) error {
+	conn, err := net.DialTimeout("tcp", port25Addr, 10*time.Second)
+	if err != nil {
+		return fmt.Errorf("dial %s: %w", port25Addr, err)
+	}
+	defer conn.Close()
+	_ = conn.SetDeadline(time.Now().Add(60 * time.Second))
+	tp := textproto.NewConn(conn)
+	expect := func(code int, after string) error {
+		if _, _, err := tp.ReadResponse(code); err != nil {
+			return fmt.Errorf("after %s: %w", after, err)
+		}
+		return nil
+	}
+	if err := expect(220, "connect"); err != nil {
+		return err
+	}
+	for _, step := range []struct {
+		cmd  string
+		code int
+	}{
+		{"HELO mx.stranger.e2e.test", 250},
+		{"MAIL FROM:<" + from + ">", 250},
+		{"RCPT TO:<" + to + ">", 250},
+		{"DATA", 354},
+	} {
+		if err := tp.PrintfLine("%s", step.cmd); err != nil {
+			return fmt.Errorf("%s: %w", step.cmd, err)
+		}
+		if err := expect(step.code, step.cmd); err != nil {
+			return err
+		}
+	}
+	if _, err := tp.W.Write(data); err != nil {
+		return fmt.Errorf("DATA content: %w", err)
+	}
+	if err := tp.W.Flush(); err != nil {
+		return fmt.Errorf("DATA content: %w", err)
+	}
+	if err := expect(250, "end of data"); err != nil {
+		return err
+	}
+	_ = tp.PrintfLine("QUIT")
+	return nil
+}
@@ -51,6 +51,9 @@ var port25Cases = []port25Case{
 			// The log tailer tells this listener's refusals from the
 			// submission ports' by the name they are logged under.
 			{param: "syslog_name", contains: "postfix/inbound", wantExact: true},
+			// The SMTP-smuggling defence, off by default on this Postfix
+			// (own-mta-builds, § 5); testInboundBareNewline drives it.
+			{param: "smtpd_forbid_bare_newline", contains: "normalize", wantExact: true},
 			// No antispam milter configured: the inbound journal milter
 			// alone. The submission chain (strict OpenDKIM + journal-milter)
 			// must not reach inbound mail.
@@ -6,6 +6,8 @@ import (
 	"encoding/base64"
 	"fmt"
 	"net/url"
+	"os"
+	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
@@ -456,3 +458,58 @@ func testInboundRelay(t *testing.T, sc *scenario) {
 		t.Fatalf("deny_domain.map after removing %s:\n%s", spammer, got)
 	}
 }
+
+// testInboundBareNewline: port 25 ends DATA only at the standard
+// <CR><LF>.<CR><LF>. A "." line that a bare <LF> precedes or ends - the SMTP
+// smuggling sequence, with a second transaction's commands behind it - is
+// body, and the one message delivered carries all of it; nothing is read as
+// a second transaction (smtpd_forbid_bare_newline=normalize on smtp/inet,
+// build/postfix-config.sh; Postfix 3.7.11, src/smtpd/smtpd.c:3649-3652).
+// Runs after testInboundRelay, whose domain, upstream and recipient it uses.
+func testInboundBareNewline(t *testing.T, sc *scenario) {
+	token := uniqueToken("inbound-bare")
+	smuggled := uniqueToken("smuggled")
+	data := "From: someone@stranger.e2e.test\r\nTo: " + inboundRecipient +
+		"\r\nSubject: e2e " + token + "\r\nDate: " + time.Now().UTC().Format(time.RFC1123Z) +
+		"\r\n\r\nthe first part\n.\n" +
+		"MAIL FROM:<someone@stranger.e2e.test>\r\nRCPT TO:<" + inboundRecipient + ">\r\nDATA\r\n" +
+		"Subject: e2e " + smuggled + "\r\n\r\nthe part a smuggler would send\r\n.\r\n"
+	if err := deliverPort25Raw("someone@stranger.e2e.test", inboundRecipient, []byte(data)); err != nil {
+		t.Fatalf("port 25 did not take the message with a bare-newline \".\" inside: %v\n%s", err, mailLogTail(h, "postfix/"))
+	}
+	raw, err := findSinkMessage(h.stageDir, token, 30*time.Second)
+	if err != nil {
+		t.Fatalf("the message never reached the upstream: %v\n%s", err, mailLogTail(h, "postfix/"))
+	}
+	if !bytes.Contains(raw, []byte(smuggled)) {
+		t.Fatalf("the message was cut at the bare-newline \".\": what followed it is not in the delivered message\n%s", raw)
+	}
+	// A second transaction, had Postfix read one, would be delivered right
+	// behind the first: give it the time and count the files that carry the
+	// smuggled token.
+	time.Sleep(3 * time.Second)
+	if n := sinkMessagesWith(t, h.stageDir, smuggled); n != 1 {
+		t.Fatalf("%d messages at the upstream carry the smuggled part, want 1\n%s", n, mailLogTail(h, "postfix/"))
+	}
+}
+
+// sinkMessagesWith counts the sink's dumped messages that contain token.
+func sinkMessagesWith(t *testing.T, stageDir, token string) int {
+	t.Helper()
+	dir := filepath.Join(stageDir, "mail-stage")
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		t.Fatalf("read %s: %v", dir, err)
+	}
+	n := 0
+	for _, e := range entries {
+		if e.IsDir() {
+			continue
+		}
+		b, err := os.ReadFile(filepath.Join(dir, e.Name()))
+		if err == nil && bytes.Contains(b, []byte(token)) {
+			n++
+		}
+	}
+	return n
+}