The DNS query type (default: "ns") and DNS query name (default: +".") that Postfix may use to determine whether DNSSEC validation +is available. +
+ +Background: DNSSEC validation is needed for Postfix DANE support; +this ensures that Postfix receives TLSA records with secure TLS +server certificate info. When DNSSEC validation is unavailable, +mail deliveries using opportunistic DANE will not be protected +by server certificate info in TLSA records, and mail deliveries +using mandatory DANE will not be made at all.
+ +By default, a Postfix process will send a DNSSEC probe after +1) the process made a DNS query that requested DNSSEC validation, +2) the process did not receive a DNSSEC validated response to this +query or to an earlier query, and 3) the process did not already +send a DNSSEC probe.
+ +
When the DNSSEC probe has no response, or when the response is +not DNSSEC validated, Postfix logs a warning that DNSSEC validation +may be unavailable.
+ +Example:
+ ++warning: DNSSEC validation may be unavailable +warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated +warning: reason: dnssec_probe 'ns:.' received no response: Server failure ++ +
Possible reasons why DNSSEC validation may be unavailable:
+ +By default, the DNSSEC probe asks for the DNS root zone NS +records, because resolvers should always have that information +cached. If Postfix runs on a network where the DNS root zone is not +reachable, specify a different probe, or specify an empty dnssec_probe +value to disable the feature.
+ +This feature was backported from Postfix 3.6 to Postfix versions +3.5.9, 3.4.19, 3.3.16. 3.2.21.
+ + +The TLS policy for MX hosts with "secure" TLSA records when the nexthop destination security level is dane, but the MX @@ -11901,6 +11961,12 @@ "Verified", because the MX host name could have been forged.
The default setting for Postfix ≥ 3.6 is "dane" with +"smtp_tls_security_level = dane", otherwise "may". This behavior +was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21. +With earlier +Postfix versions the default setting was always "dane".
+Though with "insecure" MX records an active attacker can compromise SMTP transport security by returning forged MX records, such attacks are "tamper-evident" since any forged MX hostnames diff -ur --new-file /var/tmp/postfix-3.2.20/html/smtp.8.html ./html/smtp.8.html --- /var/tmp/postfix-3.2.20/html/smtp.8.html 2019-06-29 19:03:41.000000000 -0400 +++ ./html/smtp.8.html 2021-01-16 20:28:51.042916000 -0500 @@ -303,6 +303,13 @@ smtp_dns_reply_filter (empty) Optional filter for Postfix SMTP client DNS lookup results. + Available in Postfix 3.2.21 and later: + + dnssec_probe (ns:.) + The DNS query type (default: "ns") and DNS query name (default: + ".") that Postfix may use to determine whether DNSSEC validation + is available. + MIME PROCESSING CONTROLS Available in Postfix version 2.0 and later: diff -ur --new-file /var/tmp/postfix-3.2.20/makedefs ./makedefs --- /var/tmp/postfix-3.2.20/makedefs 2020-05-06 10:10:30.000000000 -0400 +++ ./makedefs 2021-01-16 20:17:19.000000000 -0500 @@ -223,19 +223,6 @@ *) echo usage: $0 [system release] 1>&2; exit 1;; esac -case "$SYSTEM" in - Linux) - case "`PATH=/bin:/usr/bin ldd /bin/sh`" in - *-musl-*) - case "$CCARGS" in - *-DNO_DNSSEC*) ;; - *) echo Warning: libc-musl breaks DANE/TLSA security. 1>&2 - echo This build will not support DANE/TLSA. 1>&2 - CCARGS="$CCARGS -DNO_DNSSEC";; - esac;; - esac;; -esac - case "$SYSTEM.$RELEASE" in SCO_SV.3.2) SYSTYPE=SCO5 # Use the native compiler by default diff -ur --new-file /var/tmp/postfix-3.2.20/man/man5/postconf.5 ./man/man5/postconf.5 --- /var/tmp/postfix-3.2.20/man/man5/postconf.5 2019-06-29 09:34:06.000000000 -0400 +++ ./man/man5/postconf.5 2021-01-17 10:14:24.000000000 -0500 @@ -1887,6 +1887,60 @@ service performs DNS white/blacklist lookups. .PP This feature is available in Postfix 2.8 and later. +.SH dnssec_probe (default: ns:.) +The DNS query type (default: "ns") and DNS query name (default: +".") that Postfix may use to determine whether DNSSEC validation +is available. +.PP +Background: DNSSEC validation is needed for Postfix DANE support; +this ensures that Postfix receives TLSA records with secure TLS +server certificate info. When DNSSEC validation is unavailable, +mail deliveries using \fIopportunistic\fR DANE will not be protected +by server certificate info in TLSA records, and mail deliveries +using \fImandatory\fR DANE will not be made at all. +.PP +By default, a Postfix process will send a DNSSEC probe after +1) the process made a DNS query that requested DNSSEC validation, +2) the process did not receive a DNSSEC validated response to this +query or to an earlier query, and 3) the process did not already +send a DNSSEC probe. +.PP +When the DNSSEC probe has no response, or when the response is +not DNSSEC validated, Postfix logs a warning that DNSSEC validation +may be unavailable. +.PP +Example: +.PP +.nf +.na +.ft C +warning: DNSSEC validation may be unavailable +warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated +warning: reason: dnssec_probe 'ns:.' received no response: Server failure +.fi +.ad +.ft R +.PP +Possible reasons why DNSSEC validation may be unavailable: +.IP \(bu +The local /etc/resolv.conf file specifies a DNS resolver that +does not validate DNSSEC signatures (that's +$queue_directory/etc/resolv.conf when a Postfix daemon runs in a +chroot jail). +.IP \(bu +The local system library does not pass on the "DNSSEC validated" +bit to Postfix, or Postfix does not know how to ask the library to +do that. +.br +.PP +By default, the DNSSEC probe asks for the DNS root zone NS +records, because resolvers should always have that information +cached. If Postfix runs on a network where the DNS root zone is not +reachable, specify a different probe, or specify an empty dnssec_probe +value to disable the feature. +.PP +This feature was backported from Postfix 3.6 to Postfix versions +3.5.9, 3.4.19, 3.3.16. 3.2.21. .SH dont_remove (default: 0) Don't remove queue files and save them to the "saved" mail queue. This is a debugging aid. To inspect the envelope information and @@ -7491,7 +7545,7 @@ This feature is available in Postfix 2.6 and later. With earlier Postfix releases only the smtp_tls_mandatory_ciphers parameter is implemented, and opportunistic TLS always uses "export" or better (i.e. all) ciphers. -.SH smtp_tls_dane_insecure_mx_policy (default: dane) +.SH smtp_tls_dane_insecure_mx_policy (default: see "postconf \-d" output) The TLS policy for MX hosts with "secure" TLSA records when the nexthop destination security level is \fBdane\fR, but the MX record was found via an "insecure" MX lookup. The choices are: @@ -7512,6 +7566,12 @@ "Verified", because the MX host name could have been forged. .br .br +The default setting for Postfix >= 3.6 is "dane" with +"smtp_tls_security_level = dane", otherwise "may". This behavior +was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21. +With earlier +Postfix versions the default setting was always "dane". +.PP Though with "insecure" MX records an active attacker can compromise SMTP transport security by returning forged MX records, such attacks are "tamper\-evident" since any forged MX hostnames diff -ur --new-file /var/tmp/postfix-3.2.20/man/man8/smtp.8 ./man/man8/smtp.8 --- /var/tmp/postfix-3.2.20/man/man8/smtp.8 2019-06-29 09:34:06.000000000 -0400 +++ ./man/man8/smtp.8 2021-01-16 20:28:56.000000000 -0500 @@ -285,6 +285,12 @@ deliveries. .IP "\fBsmtp_dns_reply_filter (empty)\fR" Optional filter for Postfix SMTP client DNS lookup results. +.PP +Available in Postfix 3.2.21 and later: +.IP "\fBdnssec_probe (ns:.)\fR" +The DNS query type (default: "ns") and DNS query name (default: +".") that Postfix may use to determine whether DNSSEC validation +is available. .SH "MIME PROCESSING CONTROLS" .na .nf diff -ur --new-file /var/tmp/postfix-3.2.20/mantools/postlink ./mantools/postlink --- /var/tmp/postfix-3.2.20/mantools/postlink 2019-06-25 17:14:41.000000000 -0400 +++ ./mantools/postlink 2021-01-16 20:18:26.000000000 -0500 @@ -687,6 +687,7 @@ s;\bsmtp_address_preference\b;$&;g; s;\bsmtp_per_record_deadline\b;$&;g; s;\bsmtp_send_dummy_mail_auth\b;$&;g; + s;\bdnssec_probe\b;$&;g; s;\bsmtpd_enforce_tls\b;$&;g; s;\bsmtpd_sasl_tls_security_options\b;$&;g; s;\bsmtpd_sasl_type\b;$&;g; diff -ur --new-file /var/tmp/postfix-3.2.20/proto/postconf.proto ./proto/postconf.proto --- /var/tmp/postfix-3.2.20/proto/postconf.proto 2019-06-28 17:20:43.000000000 -0400 +++ ./proto/postconf.proto 2021-01-17 10:14:19.000000000 -0500 @@ -16624,7 +16624,7 @@ This feature is available in Postfix 3.1 and later.
-%PARAM smtp_tls_dane_insecure_mx_policy dane +%PARAM smtp_tls_dane_insecure_mx_policy see "postconf -d" outputThe TLS policy for MX hosts with "secure" TLSA records when the nexthop destination security level is dane, but the MX @@ -16648,6 +16648,12 @@ "Verified", because the MX host name could have been forged.
The default setting for Postfix ≥ 3.6 is "dane" with +"smtp_tls_security_level = dane", otherwise "may". This behavior +was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21. +With earlier +Postfix versions the default setting was always "dane".
+Though with "insecure" MX records an active attacker can compromise SMTP transport security by returning forged MX records, such attacks are "tamper-evident" since any forged MX hostnames @@ -16739,3 +16745,59 @@
This feature is available in Postfix 3.2 and later.
+ +%PARAM dnssec_probe ns:. + +The DNS query type (default: "ns") and DNS query name (default: +".") that Postfix may use to determine whether DNSSEC validation +is available. +
+ +Background: DNSSEC validation is needed for Postfix DANE support; +this ensures that Postfix receives TLSA records with secure TLS +server certificate info. When DNSSEC validation is unavailable, +mail deliveries using opportunistic DANE will not be protected +by server certificate info in TLSA records, and mail deliveries +using mandatory DANE will not be made at all.
+ +By default, a Postfix process will send a DNSSEC probe after +1) the process made a DNS query that requested DNSSEC validation, +2) the process did not receive a DNSSEC validated response to this +query or to an earlier query, and 3) the process did not already +send a DNSSEC probe.
+ +
When the DNSSEC probe has no response, or when the response is +not DNSSEC validated, Postfix logs a warning that DNSSEC validation +may be unavailable.
+ +Example:
+ ++warning: DNSSEC validation may be unavailable +warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated +warning: reason: dnssec_probe 'ns:.' received no response: Server failure ++ +
Possible reasons why DNSSEC validation may be unavailable:
+ +By default, the DNSSEC probe asks for the DNS root zone NS +records, because resolvers should always have that information +cached. If Postfix runs on a network where the DNS root zone is not +reachable, specify a different probe, or specify an empty dnssec_probe +value to disable the feature.
+ +This feature was backported from Postfix 3.6 to Postfix versions +3.5.9, 3.4.19, 3.3.16. 3.2.21.
diff -ur --new-file /var/tmp/postfix-3.2.20/src/dns/Makefile.in ./src/dns/Makefile.in --- /var/tmp/postfix-3.2.20/src/dns/Makefile.in 2017-02-05 18:36:27.000000000 -0500 +++ ./src/dns/Makefile.in 2021-01-16 20:17:19.000000000 -0500 @@ -1,10 +1,10 @@ SHELL = /bin/sh SRCS = dns_lookup.c dns_rr.c dns_strerror.c dns_strtype.c dns_rr_to_pa.c \ dns_sa_to_rr.c dns_rr_eq_sa.c dns_rr_to_sa.c dns_strrecord.c \ - dns_rr_filter.c dns_str_resflags.c + dns_rr_filter.c dns_str_resflags.c dns_sec.c OBJS = dns_lookup.o dns_rr.o dns_strerror.o dns_strtype.o dns_rr_to_pa.o \ dns_sa_to_rr.o dns_rr_eq_sa.o dns_rr_to_sa.o dns_strrecord.o \ - dns_rr_filter.o dns_str_resflags.o + dns_rr_filter.o dns_str_resflags.o dns_sec.o HDRS = dns.h TESTSRC = test_dns_lookup.c test_alias_token.c DEFS = -I. -I$(INC_DIR) -D$(SYSTYPE) @@ -76,7 +76,7 @@ done cd $(INC_DIR); chmod 644 $(HDRS) -test_dns_lookup: test_dns_lookup.c $(LIB) $(LIBS) +test_dns_lookup: test_dns_lookup.c all $(LIB) $(LIBS) $(CC) $(CFLAGS) -o $@ $@.c $(LIB) $(LIBS) $(SYSLIBS) dns_rr_to_pa: $(LIB) $(LIBS) @@ -354,6 +354,18 @@ dns_sa_to_rr.o: ../../include/vstring.h dns_sa_to_rr.o: dns.h dns_sa_to_rr.o: dns_sa_to_rr.c +dns_sec.o: ../../include/check_arg.h +dns_sec.o: ../../include/mail_params.h +dns_sec.o: ../../include/msg.h +dns_sec.o: ../../include/myaddrinfo.h +dns_sec.o: ../../include/mymalloc.h +dns_sec.o: ../../include/sock_addr.h +dns_sec.o: ../../include/split_at.h +dns_sec.o: ../../include/sys_defs.h +dns_sec.o: ../../include/vbuf.h +dns_sec.o: ../../include/vstring.h +dns_sec.o: dns.h +dns_sec.o: dns_sec.c dns_str_resflags.o: ../../include/check_arg.h dns_str_resflags.o: ../../include/myaddrinfo.h dns_str_resflags.o: ../../include/name_mask.h diff -ur --new-file /var/tmp/postfix-3.2.20/src/dns/dns.h ./src/dns/dns.h --- /var/tmp/postfix-3.2.20/src/dns/dns.h 2020-04-18 11:45:41.000000000 -0400 +++ ./src/dns/dns.h 2021-01-16 20:17:19.000000000 -0500 @@ -244,7 +244,12 @@ (lflags), (ltype)) /* - * Request flags. + * The dns_lookup() rflag that requests DNSSEC validation. + */ +#define DNS_WANT_DNSSEC_VALIDATION(rflags) ((rflags) & RES_USE_DNSSEC) + + /* + * lflags. */ #define DNS_REQ_FLAG_STOP_OK (1<<0) #define DNS_REQ_FLAG_STOP_INVAL (1<<1) @@ -309,6 +314,18 @@ */ const char *dns_str_resflags(unsigned long); + /* + * dns_sec.c. + */ +#define DNS_SEC_FLAG_AVAILABLE (1<<0) /* got some DNSSEC validated reply */ +#define DNS_SEC_FLAG_DONT_PROBE (1<<1) /* probe already sent, or disabled */ + +#define DNS_SEC_STATS_SET(flags) (dns_sec_stats |= (flags)) +#define DNS_SEC_STATS_TEST(flags) (dns_sec_stats & (flags)) + +extern int dns_sec_stats; /* See DNS_SEC_FLAG_XXX above */ +extern void dns_sec_probe(int); + /* LICENSE /* .ad /* .fi diff -ur --new-file /var/tmp/postfix-3.2.20/src/dns/dns_lookup.c ./src/dns/dns_lookup.c --- /var/tmp/postfix-3.2.20/src/dns/dns_lookup.c 2020-04-18 11:45:41.000000000 -0400 +++ ./src/dns/dns_lookup.c 2021-01-16 20:17:19.000000000 -0500 @@ -169,6 +169,12 @@ /* Pointer to storage for the reply RCODE value. This gives /* more detailed information than DNS_FAIL, DNS_RETRY, etc. /* DIAGNOSTICS +/* If DNSSEC validation is requested but the response is not +/* DNSSEC validated, dns_lookup() will send a one-time probe +/* query as configured with the \fBdnssec_probe\fR configuration +/* parameter, and will log a warning when the probe response +/* was not DNSSEC validated. +/* .PP /* dns_lookup() returns one of the following codes and sets the /* \fIwhy\fR argument accordingly: /* .IP DNS_OK @@ -458,7 +464,7 @@ */ #define XTRA_FLAGS (RES_USE_EDNS0 | RES_TRUSTAD) - if (flags & RES_USE_DNSSEC) + if (DNS_WANT_DNSSEC_VALIDATION(flags)) flags |= (RES_USE_EDNS0 | RES_TRUSTAD); /* @@ -487,6 +493,8 @@ _res.options |= saved_options; reply_header = (HEADER *) reply->buf; reply->rcode = reply_header->rcode; + if ((reply->dnssec_ad = !!reply_header->ad) != 0) + DNS_SEC_STATS_SET(DNS_SEC_FLAG_AVAILABLE); if (h_errno != 0) { if (why) vstring_sprintf(why, "Host or domain name not found. " @@ -538,13 +546,8 @@ /* * Initialize the reply structure. Some structure members are filled on - * the fly while the reply is being parsed. Coerce AD bit to boolean. + * the fly while the reply is being parsed. */ -#if RES_USE_DNSSEC != 0 - reply->dnssec_ad = (flags & RES_USE_DNSSEC) ? !!reply_header->ad : 0; -#else - reply->dnssec_ad = 0; -#endif SET_HAVE_DNS_REPLY_PACKET(reply, len); reply->query_start = reply->buf + sizeof(HEADER); reply->answer_start = 0; @@ -862,7 +865,9 @@ CORRUPT(DNS_RETRY); if ((status = dns_get_fixed(pos, &fixed)) != DNS_OK) CORRUPT(status); - if (!valid_rr_name(rr_name, "resource name", fixed.type, reply)) + if (strcmp(orig_name, ".") == 0 && *rr_name == 0) + /* Allow empty response name for root queries. */ ; + else if (!valid_rr_name(rr_name, "resource name", fixed.type, reply)) CORRUPT(DNS_INVAL); if (fqdn) vstring_strcpy(fqdn, rr_name); @@ -950,7 +955,7 @@ /* * The Linux resolver misbehaves when given an invalid domain name. */ - if (!valid_hostname(name, DONT_GRIPE)) { + if (strcmp(name, ".") && !valid_hostname(name, DONT_GRIPE)) { if (why) vstring_sprintf(why, "Name service error for %s: invalid host or domain name", @@ -987,6 +992,10 @@ (void) dns_get_answer(orig_name, &reply, T_SOA, rrlist, fqdn, cname, c_len, &maybe_secure); } + if (DNS_WANT_DNSSEC_VALIDATION(flags) + && !DNS_SEC_STATS_TEST(DNS_SEC_FLAG_AVAILABLE | \ + DNS_SEC_FLAG_DONT_PROBE)) + dns_sec_probe(flags); /* XXX Clobbers 'reply' */ return (status); } @@ -996,6 +1005,10 @@ */ status = dns_get_answer(orig_name, &reply, type, rrlist, fqdn, cname, c_len, &maybe_secure); + if (DNS_WANT_DNSSEC_VALIDATION(flags) + && !DNS_SEC_STATS_TEST(DNS_SEC_FLAG_AVAILABLE | \ + DNS_SEC_FLAG_DONT_PROBE)) + dns_sec_probe(flags); /* XXX Clobbers 'reply' */ switch (status) { default: if (why) diff -ur --new-file /var/tmp/postfix-3.2.20/src/dns/dns_sec.c ./src/dns/dns_sec.c --- /var/tmp/postfix-3.2.20/src/dns/dns_sec.c 1969-12-31 19:00:00.000000000 -0500 +++ ./src/dns/dns_sec.c 2021-01-11 18:32:06.000000000 -0500 @@ -0,0 +1,144 @@ +/*++ +/* NAME +/* dns_sec 3 +/* SUMMARY +/* DNSSEC validation availability +/* SYNOPSIS +/* #include