[ Impact ]
After a breaking change in OpenSSL 3, postfix users have experienced
warning messages and missed opportunities for TLS session reuse. To avoid this, upstream included this workaround that consists of turning on SSL_OP_IGNORE_UNEXPECTED_EOF always.
[ Test Plan ]
A bad scenario test case has been provided in comment #10, and after installing the proposed package for this SRU the same steps can be used for verification (like in comment #14). Therefore, the steps will be the following:
### Bad Case
#0. In a VM/container with Jammy (i.e):
# lxc launch ubuntu-daily:jammy Jpostfix
# lxc shell Jpostfix
# apt update && apt upgrade -y
# apt install postfix -y (I selected local installation)
#1. Run the connection:
# openssl s_client --connect localhost:25 -starttls smtp
#2. Interrupt the connection: Press CTrl-C
#3. Check the log for the present warning message:
# grep warning /var/log/mail.log | grep 0A000126
### Good Case
#4. Enable & install proposed package:
#cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
# Enable Ubuntu proposed archive
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF
#apt update && apt upgrade -y
#5. Clean log to remove the warning message for Bad case,
returning to old log (thanks to Bryce Harrington for the hint and suggestion):
#savelog -g adm -m 640 -u syslog -c 7 /var/log/mail.log
#6. Repeat steps 1,2 and 3: no more warning messages appears
(grep returns nothing).
Also, an integration test script is present in the autopkgtests, which
have been run in a PPA and in autopkgtest.ubuntu.com. The autopkgtests passed.
In addition, Simon Déziel has been so kind of doing manual tests on
Jammy with satisfactory results.
[ Where problems could occur ]
This fix is part of a stable microrelase. As indicated in the PostfixUpdates MRE exception "Upstream has tight requirements for what goes into stable microreleases, QAs them with regression tests, and has a good history of not breaking anything", which doesn't imply risk-free.
In particular, they commented the following about this change in The HISTORY file: "This is safe because the SMTP protocol implements application-level framing, and is therefore not affected by TLS truncation attacks".
The autopkgtest tests checked the relationships with the versions of the available dependencies and other package-specific issues which is probably what we should focus on to mitigate possible regression scenarios.
[ Other Info ]
The package also fixes LP: #1996524 (SRU template completed there as well).
[ Original Report ]
------------------------------------
I have upgrade the mail system from 20.04 to 22.04
I am getting tls errors:
postfix/smtpd[22909]: warning: TLS library problem: error:0A000126:SSL routines::unexpected eof while reading:../ssl/record/rec_layer_s3.c:308:
ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: postfix 3.6.4-1ubuntu1
ProcVersionSignature: Ubuntu 5.15.0-50.56-generic 5.15.60
Uname: Linux 5.15.0-50-generic x86_64
NonfreeKernelModules: cpuid tls binfmt_misc veth nf_tables nfnetlink bridge stp llc zfs zunicode zzstd amd64_edac zlua edac_mce_amd zavl icp kvm_amd zcommon ccp znvpair kvm ipmi_si spl serio_raw joydev ipmi_devintf input_leds ipmi_msghandler cp210x usbserial fam15h_power k10temp mac_hid sch_fq_codel nfsd auth_rpcgss nfs_acl lockd grace ramoops pstore_blk reed_solomon pstore_zone efi_pstore sunrpc ip_tables x_tables autofs4 btrfs blake2b_generic xor zstd_compress raid6_pq libcrc32c dm_mirror dm_region_hash dm_log mgag200 drm_kms_helper uas syscopyarea sysfillrect sysimgblt usb_storage fb_sys_fops crct10dif_pclmul mvsas crc32_pclmul cec hid_generic ghash_clmulni_intel rc_core igb usbhid libsas aesni_intel xhci_pci crypto_simd ahci dca drm cryptd psmouse xhci_pci_renesas i2c_piix4 hid scsi_transport_sas libahci i2c_algo_bit
ApportVersion: 2.20.11-0ubuntu82.1
Architecture: amd64
CasperMD5CheckResult: unknown
Date: Mon Oct 31 18:11:47 2022
EtcMailname: mail.mlb.org
Hostname: mail.mlb.org
PostconfMydomain: mlb.org
PostconfMyhostname: mail.mlb.org
PostconfMyorigin: mail.mlb.org
ProcEnviron:
SHELL=/bin/bash
LANG=en_US.UTF-8
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
PATH=(custom, no user)
RebootRequiredPkgs: Error: path contained symlinks.
SourcePackage: postfix
UpgradeStatus: No upgrade log present (probably fresh install)
after google more about postfix and openssl 3 and see that
version 3.7 support openssl 3
URL: https:/
Support for library APIs: OpenSSL 3.0.0, PCRE2, Berkeley DB 18.
From Release notes:
URL: https:/
[Feature 20210926] Postfix was updated to support OpenSSL 3.0.0 API
features, and to work around OpenSSL 3.0.0 bit-rot (avoid using
deprecated API features).
It look like the version mismatch of postfix and openssl version.
From the above it look like postfix version 3.7 is first version to
support openssl 3