A workaround for implementations that hang Postfix while shuting +down a TLS session, until Postfix times out. With this enabled, +Postfix will not wait for the remote TLS peer to respond to a TLS +'close' notification. This behavior is recommended for TLSv1.0 and +later.
+ +This feature was introduced with Postfix 3.4.6, 3.3.5, 3.2.10, +and 3.1.13.
+ + +This feature is available in Postfix 2.11 and later.
diff -ur --new-file /var/tmp/postfix-3.4.5/html/smtp.8.html ./html/smtp.8.html --- /var/tmp/postfix-3.4.5/html/smtp.8.html 2019-02-10 12:18:26.000000000 -0500 +++ ./html/smtp.8.html 2019-06-29 19:30:31.000000000 -0400 @@ -120,9 +120,8 @@ ter is notified of bounces, protocol problems, and of other trouble. BUGS - SMTP and LMTP connection caching does not work with TLS. The necessary - support for TLS object passivation and re-activation does not exist - without closing the session, which defeats the purpose. + SMTP and LMTP connection reuse for TLS (without closing the SMTP or + LMTP connection) is not supported before Postfix 3.4. SMTP and LMTP connection caching assumes that SASL credentials are valid for all destinations that map onto the same IP address and TCP @@ -595,6 +594,12 @@ Optional name to send to the remote SMTP server in the TLS Server Name Indication (SNI) extension. + Introduced with Postfix 3.4.6, 3.3.5, 3.2.10, and 3.1.13: + + tls_fast_shutdown_enable (yes) + A workaround for implementations that hang Postfix while shuting + down a TLS session, until Postfix times out. + OBSOLETE STARTTLS CONTROLS The following configuration parameters exist for compatibility with Postfix versions before 2.3. Support for these will be removed in a diff -ur --new-file /var/tmp/postfix-3.4.5/html/smtpd.8.html ./html/smtpd.8.html --- /var/tmp/postfix-3.4.5/html/smtpd.8.html 2019-02-10 17:53:18.000000000 -0500 +++ ./html/smtpd.8.html 2019-06-29 19:22:10.000000000 -0400 @@ -589,6 +589,12 @@ clients via the TLS Server Name Indication (SNI) extension to the appropriate keys and certificate chains. + Introduced with Postfix 3.4.6, 3.3.5, 3.2.10, and 3.1.13: + + tls_fast_shutdown_enable (yes) + A workaround for implementations that hang Postfix while shuting + down a TLS session, until Postfix times out. + OBSOLETE STARTTLS CONTROLS The following configuration parameters exist for compatibility with Postfix versions before 2.3. Support for these will be removed in a diff -ur --new-file /var/tmp/postfix-3.4.5/html/tlsproxy.8.html ./html/tlsproxy.8.html --- /var/tmp/postfix-3.4.5/html/tlsproxy.8.html 2019-02-21 19:27:46.000000000 -0500 +++ ./html/tlsproxy.8.html 2019-06-29 19:23:07.000000000 -0400 @@ -337,6 +337,12 @@ usage policy by next-hop destination and by remote TLS server hostname. + Introduced with Postfix 3.4.6, 3.3.5, 3.2.10, and 3.1.13: + + tls_fast_shutdown_enable (yes) + A workaround for implementations that hang Postfix while shuting + down a TLS session, until Postfix times out. + OBSOLETE STARTTLS SUPPORT CONTROLS These parameters are supported for compatibility with smtpd(8) legacy parameters. diff -ur --new-file /var/tmp/postfix-3.4.5/man/man5/postconf.5 ./man/man5/postconf.5 --- /var/tmp/postfix-3.4.5/man/man5/postconf.5 2019-03-24 18:59:03.000000000 -0400 +++ ./man/man5/postconf.5 2019-06-29 09:33:39.000000000 -0400 @@ -12930,6 +12930,15 @@ encouraged to not change this setting. .PP This feature is available in Postfix 2.3 and later. +.SH tls_fast_shutdown_enable (default: yes) +A workaround for implementations that hang Postfix while shuting +down a TLS session, until Postfix times out. With this enabled, +Postfix will not wait for the remote TLS peer to respond to a TLS +'close' notification. This behavior is recommended for TLSv1.0 and +later. +.PP +This feature was introduced with Postfix 3.4.6, 3.3.5, 3.2.10, +and 3.1.13. .SH tls_high_cipherlist (default: see "postconf \-d" output) The OpenSSL cipherlist for "high" grade ciphers. This defines the meaning of the "high" setting in smtpd_tls_ciphers, @@ -13221,10 +13230,6 @@ .IP "\fBPRIORITIZE_CHACHA\fR" Postfix >= 3.4. See SSL_CTX_\fBset_options\fR(3). .br -.IP "\fBTLSEXT_PADDING\fR" -Postfix >= 3.4. See -SSL_CTX_\fBset_options\fR(3). -.br .br .PP This feature is available in Postfix 2.11 and later. diff -ur --new-file /var/tmp/postfix-3.4.5/man/man8/smtp.8 ./man/man8/smtp.8 --- /var/tmp/postfix-3.4.5/man/man8/smtp.8 2019-02-10 12:18:26.000000000 -0500 +++ ./man/man8/smtp.8 2019-06-29 09:33:39.000000000 -0400 @@ -127,9 +127,8 @@ .SH BUGS .ad .fi -SMTP and LMTP connection caching does not work with TLS. The necessary -support for TLS object passivation and re\-activation does not -exist without closing the session, which defeats the purpose. +SMTP and LMTP connection reuse for TLS (without closing the +SMTP or LMTP connection) is not supported before Postfix 3.4. SMTP and LMTP connection caching assumes that SASL credentials are valid for all destinations that map onto the same IP @@ -526,6 +525,11 @@ .IP "\fBsmtp_tls_servername (empty)\fR" Optional name to send to the remote SMTP server in the TLS Server Name Indication (SNI) extension. +.PP +Introduced with Postfix 3.4.6, 3.3.5, 3.2.10, and 3.1.13: +.IP "\fBtls_fast_shutdown_enable (yes)\fR" +A workaround for implementations that hang Postfix while shuting +down a TLS session, until Postfix times out. .SH "OBSOLETE STARTTLS CONTROLS" .na .nf diff -ur --new-file /var/tmp/postfix-3.4.5/man/man8/smtpd.8 ./man/man8/smtpd.8 --- /var/tmp/postfix-3.4.5/man/man8/smtpd.8 2019-02-10 17:53:17.000000000 -0500 +++ ./man/man8/smtpd.8 2019-06-29 09:33:39.000000000 -0400 @@ -527,6 +527,11 @@ Optional lookup tables that map names received from remote SMTP clients via the TLS Server Name Indication (SNI) extension to the appropriate keys and certificate chains. +.PP +Introduced with Postfix 3.4.6, 3.3.5, 3.2.10, and 3.1.13: +.IP "\fBtls_fast_shutdown_enable (yes)\fR" +A workaround for implementations that hang Postfix while shuting +down a TLS session, until Postfix times out. .SH "OBSOLETE STARTTLS CONTROLS" .na .nf diff -ur --new-file /var/tmp/postfix-3.4.5/man/man8/tlsproxy.8 ./man/man8/tlsproxy.8 --- /var/tmp/postfix-3.4.5/man/man8/tlsproxy.8 2019-02-21 19:27:45.000000000 -0500 +++ ./man/man8/tlsproxy.8 2019-06-29 09:33:40.000000000 -0400 @@ -302,6 +302,11 @@ Optional lookup tables with the Postfix \fBtlsproxy\fR(8) client TLS usage policy by next\-hop destination and by remote TLS server hostname. +.PP +Introduced with Postfix 3.4.6, 3.3.5, 3.2.10, and 3.1.13: +.IP "\fBtls_fast_shutdown_enable (yes)\fR" +A workaround for implementations that hang Postfix while shuting +down a TLS session, until Postfix times out. .SH "OBSOLETE STARTTLS SUPPORT CONTROLS" .na .nf diff -ur --new-file /var/tmp/postfix-3.4.5/mantools/postlink ./mantools/postlink --- /var/tmp/postfix-3.4.5/mantools/postlink 2019-02-10 12:11:46.000000000 -0500 +++ ./mantools/postlink 2019-06-25 08:05:54.000000000 -0400 @@ -765,6 +765,7 @@ s;\btls_ssl_options\b;$&;g; s;\btls_dane_digest_agility\b;$&;g; s;\btls_dane_trust_anchor_digest_enable\b;$&;g; + s;\btls_fast_shutdown_enable\b;$&;g; s;\bfrozen_delivered_to\b;$&;g; s;\breset_owner_alias\b;$&;g; diff -ur --new-file /var/tmp/postfix-3.4.5/proto/postconf.proto ./proto/postconf.proto --- /var/tmp/postfix-3.4.5/proto/postconf.proto 2019-03-21 12:41:06.000000000 -0400 +++ ./proto/postconf.proto 2019-06-28 17:19:58.000000000 -0400 @@ -16130,9 +16130,6 @@This feature is available in Postfix 2.11 and later.
@@ -16245,6 +16242,17 @@This feature is available in Postfix 3.0 and later.
+%PARAM tls_fast_shutdown_enable yes + +A workaround for implementations that hang Postfix while shuting +down a TLS session, until Postfix times out. With this enabled, +Postfix will not wait for the remote TLS peer to respond to a TLS +'close' notification. This behavior is recommended for TLSv1.0 and +later.
+ +This feature was introduced with Postfix 3.4.6, 3.3.5, 3.2.10, +and 3.1.13.
+ %PARAM default_delivery_status_filter Optional filter to replace the delivery status code or explanatory
diff -ur --new-file /var/tmp/postfix-3.4.5/src/global/mail_params.h ./src/global/mail_params.h
--- /var/tmp/postfix-3.4.5/src/global/mail_params.h 2019-02-11 08:05:13.000000000 -0500
+++ ./src/global/mail_params.h 2019-06-27 17:38:33.000000000 -0400
@@ -3331,6 +3331,13 @@
extern char *var_tls_dane_digests;
/*
+ * The default is backwards-incompatible.
+ */
+#define VAR_TLS_FAST_SHUTDOWN "tls_fast_shutdown"
+#define DEF_TLS_FAST_SHUTDOWN 1
+extern bool var_tls_fast_shutdown;
+
+ /*
* Sendmail-style mail filter support.
*/
#define VAR_SMTPD_MILTERS "smtpd_milters"
diff -ur --new-file /var/tmp/postfix-3.4.5/src/smtp/smtp.c ./src/smtp/smtp.c
--- /var/tmp/postfix-3.4.5/src/smtp/smtp.c 2019-02-10 12:18:26.000000000 -0500
+++ ./src/smtp/smtp.c 2019-06-29 09:33:39.000000000 -0400
@@ -109,9 +109,8 @@
/* the postmaster is notified of bounces, protocol problems, and of
/* other trouble.
/* BUGS
-/* SMTP and LMTP connection caching does not work with TLS. The necessary
-/* support for TLS object passivation and re-activation does not
-/* exist without closing the session, which defeats the purpose.
+/* SMTP and LMTP connection reuse for TLS (without closing the
+/* SMTP or LMTP connection) is not supported before Postfix 3.4.
/*
/* SMTP and LMTP connection caching assumes that SASL credentials
/* are valid for all destinations that map onto the same IP
@@ -496,6 +495,11 @@
/* .IP "\fBsmtp_tls_servername (empty)\fR"
/* Optional name to send to the remote SMTP server in the TLS Server
/* Name Indication (SNI) extension.
+/* .PP
+/* Introduced with Postfix 3.4.6, 3.3.5, 3.2.10, and 3.1.13:
+/* .IP "\fBtls_fast_shutdown_enable (yes)\fR"
+/* A workaround for implementations that hang Postfix while shuting
+/* down a TLS session, until Postfix times out.
/* OBSOLETE STARTTLS CONTROLS
/* .ad
/* .fi
diff -ur --new-file /var/tmp/postfix-3.4.5/src/smtp/smtp_addr.c ./src/smtp/smtp_addr.c
--- /var/tmp/postfix-3.4.5/src/smtp/smtp_addr.c 2017-12-27 16:53:13.000000000 -0500
+++ ./src/smtp/smtp_addr.c 2019-04-03 18:03:38.000000000 -0400
@@ -623,7 +623,7 @@
if (var_smtp_rand_addr)
addr_list = dns_rr_shuffle(addr_list);
addr_list = dns_rr_sort(addr_list, SMTP_COMPARE_ADDR(misc_flags));
- if (var_smtp_balance_inet_proto)
+ if (var_smtp_mxaddr_limit > 0 && var_smtp_balance_inet_proto)
addr_list = smtp_balance_inet_proto(addr_list, misc_flags,
var_smtp_mxaddr_limit);
}
@@ -683,7 +683,7 @@
/* The following changes the order of equal-preference hosts. */
if (inet_proto_info()->ai_family_list[1] != 0)
addr_list = dns_rr_sort(addr_list, SMTP_COMPARE_ADDR(misc_flags));
- if (var_smtp_balance_inet_proto)
+ if (var_smtp_mxaddr_limit > 0 && var_smtp_balance_inet_proto)
addr_list = smtp_balance_inet_proto(addr_list, misc_flags,
var_smtp_mxaddr_limit);
}
diff -ur --new-file /var/tmp/postfix-3.4.5/src/smtpd/smtpd.c ./src/smtpd/smtpd.c
--- /var/tmp/postfix-3.4.5/src/smtpd/smtpd.c 2019-03-30 08:05:29.000000000 -0400
+++ ./src/smtpd/smtpd.c 2019-06-29 09:33:39.000000000 -0400
@@ -493,6 +493,11 @@
/* Optional lookup tables that map names received from remote SMTP
/* clients via the TLS Server Name Indication (SNI) extension to the
/* appropriate keys and certificate chains.
+/* .PP
+/* Introduced with Postfix 3.4.6, 3.3.5, 3.2.10, and 3.1.13:
+/* .IP "\fBtls_fast_shutdown_enable (yes)\fR"
+/* A workaround for implementations that hang Postfix while shuting
+/* down a TLS session, until Postfix times out.
/* OBSOLETE STARTTLS CONTROLS
/* .ad
/* .fi
@@ -3528,6 +3533,11 @@
int saved_err;
const CLEANUP_STAT_DETAIL *detail;
+#define IS_SMTP_REJECT(s) \
+ (((s)[0] == '4' || (s)[0] == '5') \
+ && ISDIGIT((s)[1]) && ISDIGIT((s)[2]) \
+ && ((s)[3] == '\0' || (s)[3] == ' ' || (s)[3] == '-'))
+
if (state->err == CLEANUP_STAT_OK
&& SMTPD_STAND_ALONE(state) == 0
&& (err = smtpd_check_eod(state)) != 0) {
@@ -3598,7 +3608,10 @@
if (state->err == 0) {
why = vstring_alloc(10);
state->err = mail_stream_finish(state->dest, why);
- printable(STR(why), ' ');
+ if (IS_SMTP_REJECT(STR(why)))
+ printable_except(STR(why), ' ', "\r\n");
+ else
+ printable(STR(why), ' ');
} else
mail_stream_cleanup(state->dest);
state->dest = 0;
@@ -3633,11 +3646,6 @@
*
* See also: qmqpd.c
*/
-#define IS_SMTP_REJECT(s) \
- (((s)[0] == '4' || (s)[0] == '5') \
- && ISDIGIT((s)[1]) && ISDIGIT((s)[2]) \
- && ((s)[3] == '\0' || (s)[3] == ' ' || (s)[3] == '-'))
-
if (state->err == CLEANUP_STAT_OK) {
state->error_count = 0;
state->error_mask = 0;
@@ -5413,15 +5421,6 @@
case 0:
/*
- * Reset the per-command counters.
- */
- for (cmdp = smtpd_cmd_table; /* see below */ ; cmdp++) {
- cmdp->success_count = cmdp->total_count = 0;
- if (cmdp->name == 0)
- break;
- }
-
- /*
* In TLS wrapper mode, turn on TLS using code that is shared with
* the STARTTLS command. This code does not return when the handshake
* fails.
@@ -5820,6 +5819,15 @@
}
/*
+ * Reset the per-command counters.
+ */
+ for (cmdp = smtpd_cmd_table; /* see below */ ; cmdp++) {
+ cmdp->success_count = cmdp->total_count = 0;
+ if (cmdp->name == 0)
+ break;
+ }
+
+ /*
* Log total numbers, so that logfile analyzers will see something even
* if the above loop produced no output. When no commands were received
* log "0/0" to simplify the identification of abnormal sessions: any
diff -ur --new-file /var/tmp/postfix-3.4.5/src/tls/Makefile.in ./src/tls/Makefile.in
--- /var/tmp/postfix-3.4.5/src/tls/Makefile.in 2019-03-07 19:04:25.000000000 -0500
+++ ./src/tls/Makefile.in 2019-06-25 08:05:54.000000000 -0400
@@ -572,6 +572,7 @@
tls_session.o: ../../include/argv.h
tls_session.o: ../../include/check_arg.h
tls_session.o: ../../include/dns.h
+tls_session.o: ../../include/mail_params.h
tls_session.o: ../../include/msg.h
tls_session.o: ../../include/myaddrinfo.h
tls_session.o: ../../include/mymalloc.h
diff -ur --new-file /var/tmp/postfix-3.4.5/src/tls/tls_misc.c ./src/tls/tls_misc.c
--- /var/tmp/postfix-3.4.5/src/tls/tls_misc.c 2019-02-21 19:22:18.000000000 -0500
+++ ./src/tls/tls_misc.c 2019-06-25 17:51:24.000000000 -0400
@@ -46,6 +46,8 @@
/* char *var_tls_mgr_service;
/* char *var_tls_tkt_cipher;
/* char *var_openssl_path;
+/* char *var_tls_server_sni_maps;
+/* bool var_tls_fast_shutdown;
/*
/* TLS_APPL_STATE *tls_alloc_app_context(ssl_ctx, log_mask)
/* SSL_CTX *ssl_ctx;
@@ -289,6 +291,7 @@
char *var_tls_tkt_cipher;
char *var_openssl_path;
char *var_tls_server_sni_maps;
+bool var_tls_fast_shutdown;
static MAPS *tls_server_sni_maps;
@@ -625,6 +628,7 @@
VAR_TLS_BC_PKEY_FPRINT, DEF_TLS_BC_PKEY_FPRINT, &var_tls_bc_pkey_fprint,
VAR_TLS_PREEMPT_CLIST, DEF_TLS_PREEMPT_CLIST, &var_tls_preempt_clist,
VAR_TLS_MULTI_WILDCARD, DEF_TLS_MULTI_WILDCARD, &var_tls_multi_wildcard,
+ VAR_TLS_FAST_SHUTDOWN, DEF_TLS_FAST_SHUTDOWN, &var_tls_fast_shutdown,
0,
};
static int init_done;
diff -ur --new-file /var/tmp/postfix-3.4.5/src/tls/tls_session.c ./src/tls/tls_session.c
--- /var/tmp/postfix-3.4.5/src/tls/tls_session.c 2018-12-26 14:21:49.000000000 -0500
+++ ./src/tls/tls_session.c 2019-06-25 08:05:54.000000000 -0400
@@ -71,6 +71,10 @@
#include