mail/postfix: Opportunistic DANE SMTP client security level (#2418)

mail/postfix/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		postfix
-PLUGIN_VERSION=		1.22
+PLUGIN_VERSION=		1.23
 PLUGIN_COMMENT=		SMTP mail relay
 PLUGIN_DEPENDS=		postfix35
 PLUGIN_MAINTAINER=	m.muenz@gmail.com

mail/postfix/pkg-descr

@@ -6,6 +6,10 @@ is completely different.
 Plugin Changelog
 ================
 
+1.23
+
+* Add support for Opportunistic DANE as SMTP client security level
+
 1.22
 
 * Switch table format of header_checks from regexp_table to pcre_table (contributed by Starkstromkonsument)

mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml

@@ -123,7 +123,13 @@
         <id>general.smtpclient_security</id>
         <label>SMTP Client Security</label>
         <type>dropdown</type>
-        <help>Choose "none" to disable TLS for sending mail. Set encrypt to enforce TLS security, please do not use this for Internet wide communication as not every server supports TLS yet. Default is "may" which will use TLS when offered.</help>
+        <help><![CDATA[ 
+            <ul>
+                <li>'none' will disable TLS for sending mail.</li>
+                <li>'may' will use TLS when offered (Opportunistic TLS)</li>
+                <li>'encrypt' will enforce TLS on all connections. Please do not use this for Internet wide communication as not every server supports TLS yet.</li>
+                <li>'dane' will enforce TLS if a TLSA-Record is published (Opportunistic DANE, RFC 7672). DNSSEC-capable resolver is required.</li> 
+            </ul> ]]></help>
     </field>
     <field>
         <id>general.relayhost</id>

mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml

@@ -1,7 +1,7 @@
 <model>
     <mount>//OPNsense/postfix/general</mount>
     <description>Postfix configuration</description>
-    <version>1.2.6</version>
+    <version>1.2.7</version>
     <items>
         <enabled type="BooleanField">
             <default>0</default>
@@ -98,6 +98,7 @@
                 <none>none</none>
                 <may>may</may>
                 <encrypt>encrypt</encrypt>
+                <dane>dane</dane>
             </OptionValues>
         </smtpclient_security>
         <relayhost type="TextField">

mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf

@@ -89,6 +89,9 @@ smtp_tls_wrappermode = yes
 {% endif %}
 
 {% if helpers.exists('OPNsense.postfix.general.smtpclient_security') and OPNsense.postfix.general.smtpclient_security != '' %}
+{% if OPNsense.postfix.general.smtpclient_security == 'dane' %}
+smtp_dns_support_level = dnssec
+{% endif %}
 smtp_tls_security_level = {{ OPNsense.postfix.general.smtpclient_security }}
 smtp_tls_loglevel = 1
 {% endif %}