public inbox for pmg-devel@lists.proxmox.com
 help / color / mirror / Atom feed
From: Stoiko Ivanov <s.ivanov@proxmox.com>
To: pmg-devel@lists.proxmox.com
Subject: [pmg-devel] [PATCH pmg-api] templates: postfix: forbid_bare_newline on external port
Date: Tue,  2 Jan 2024 11:30:39 +0100	[thread overview]
Message-ID: <20240102103039.15709-1-s.ivanov@proxmox.com> (raw)

This patch addresses the smtp-smuggling vulnerability [0,1], with the
recommended fix by postfix upstream [2].

Disallowing bare linefeeds instead of crlf should not be a problem
with any standards-compliant MTA.
The internal port allows bare linefeed, since internal clients
(mail-scripts written ages ago, some ancient embedded systems) might
not adhere to the protocol. Additionally the mail-proxy allowlist (the
ip and cidr entries, are the only ones applicable here) is also added
to the global exceptions.

Currently the updated postfix-packages are not published in the
security repositories but only as stable updates [3,4]
However postfix ignores unknown configuration parameters and only
prints a warning to the journal - so the changes to the templates can
already be shipped, for those users who have the stable-updates mirror
enabled.

Tested with the current postfix in bookworm, then updating to the one
in bookworm-updates and running tests with netcat (verified with nc -C
that it still works with the correct line-termination):
```
$ nc -6  pmgtest 25
220 pmgtest.proxmox.com ESMTP Proxmox
EHLO pmgsender.proxmox.com
521 5.5.2 pmgtest.proxmox.com Error: bare <LF> received
```

[0] https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
[1] https://nvd.nist.gov/vuln/detail/CVE-2023-51764
[2] https://www.postfix.org/smtp-smuggling.html
[3] https://security-tracker.debian.org/tracker/CVE-2023-51764
[4] https://lists.debian.org/debian-stable-announce/2023/12/msg00004.html

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
---
 src/templates/main.cf.in   | 5 +++++
 src/templates/master.cf.in | 1 +
 2 files changed, 6 insertions(+)

diff --git a/src/templates/main.cf.in b/src/templates/main.cf.in
index c689af3..3b56355 100644
--- a/src/templates/main.cf.in
+++ b/src/templates/main.cf.in
@@ -101,6 +101,11 @@ unverified_recipient_reject_code = [% pmg.mail.verifyreceivers %]
 
 smtpd_data_restrictions = reject_unauth_pipelining
 
+smtpd_forbid_bare_newline = yes
+smtpd_forbid_bare_newline_exclusions =
+        $mynetworks,
+        cidr:/etc/postfix/clientaccess
+
 smtpd_client_connection_count_limit = [% pmg.mail.conn_count_limit %]
 smtpd_client_connection_rate_limit = [% pmg.mail.conn_rate_limit %]
 smtpd_client_message_rate_limit = [% pmg.mail.message_rate_limit %]
diff --git a/src/templates/master.cf.in b/src/templates/master.cf.in
index 7d60d1d..674767d 100644
--- a/src/templates/master.cf.in
+++ b/src/templates/master.cf.in
@@ -92,6 +92,7 @@ scan      unix  -       -       n       -       [% pmg.mail.max_filters %]
   -o smtpd_client_restrictions=
   -o smtpd_sender_restrictions=
   -o smtpd_data_restrictions=
+  -o smtpd_forbid_bare_newline = no
 
 [% pmg.mail.ext_port %]       inet  n -       -       -       1 postscreen
 
-- 
2.39.2





             reply	other threads:[~2024-01-02 10:31 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-01-02 10:30 Stoiko Ivanov [this message]
2024-01-02 11:08 ` [pmg-devel] applied: " Wolfgang Bumiller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240102103039.15709-1-s.ivanov@proxmox.com \
    --to=s.ivanov@proxmox.com \
    --cc=pmg-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal