From 22e89aaf76f82487ee192a11024bf920017e9453 Mon Sep 17 00:00:00 2001
From: windgmbh <49904312+windgmbh@users.noreply.github.com>
Date: Wed, 29 Jun 2022 14:28:20 +0200
Subject: [PATCH] mail/postfix: Opportunistic DANE SMTP client security level
 (#2418)

---
 mail/postfix/Makefile                                     | 2 +-
 mail/postfix/pkg-descr                                    | 4 ++++
 .../app/controllers/OPNsense/Postfix/forms/general.xml    | 8 +++++++-
 .../opnsense/mvc/app/models/OPNsense/Postfix/General.xml  | 3 ++-
 .../opnsense/service/templates/OPNsense/Postfix/main.cf   | 3 +++
 5 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/mail/postfix/Makefile b/mail/postfix/Makefile
index be67c238d..41188395e 100644
--- a/mail/postfix/Makefile
+++ b/mail/postfix/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		postfix
-PLUGIN_VERSION=		1.22
+PLUGIN_VERSION=		1.23
 PLUGIN_COMMENT=		SMTP mail relay
 PLUGIN_DEPENDS=		postfix35
 PLUGIN_MAINTAINER=	m.muenz@gmail.com
diff --git a/mail/postfix/pkg-descr b/mail/postfix/pkg-descr
index b45544ba6..518b619e9 100644
--- a/mail/postfix/pkg-descr
+++ b/mail/postfix/pkg-descr
@@ -6,6 +6,10 @@ is completely different.
 Plugin Changelog
 ================
 
+1.23
+
+* Add support for Opportunistic DANE as SMTP client security level
+
 1.22
 
 * Switch table format of header_checks from regexp_table to pcre_table (contributed by Starkstromkonsument)
diff --git a/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml b/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml
index 9a4eade64..272a04467 100644
--- a/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml
+++ b/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml
@@ -123,7 +123,13 @@
         <id>general.smtpclient_security</id>
         <label>SMTP Client Security</label>
         <type>dropdown</type>
-        <help>Choose "none" to disable TLS for sending mail. Set encrypt to enforce TLS security, please do not use this for Internet wide communication as not every server supports TLS yet. Default is "may" which will use TLS when offered.</help>
+        <help><![CDATA[ 
+            <ul>
+                <li>'none' will disable TLS for sending mail.</li>
+                <li>'may' will use TLS when offered (Opportunistic TLS)</li>
+                <li>'encrypt' will enforce TLS on all connections. Please do not use this for Internet wide communication as not every server supports TLS yet.</li>
+                <li>'dane' will enforce TLS if a TLSA-Record is published (Opportunistic DANE, RFC 7672). DNSSEC-capable resolver is required.</li> 
+            </ul> ]]></help>
     </field>
     <field>
         <id>general.relayhost</id>
diff --git a/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml b/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml
index 4be05625e..5a7c0c41a 100644
--- a/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml
+++ b/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml
@@ -1,7 +1,7 @@
 <model>
     <mount>//OPNsense/postfix/general</mount>
     <description>Postfix configuration</description>
-    <version>1.2.6</version>
+    <version>1.2.7</version>
     <items>
         <enabled type="BooleanField">
             <default>0</default>
@@ -98,6 +98,7 @@
                 <none>none</none>
                 <may>may</may>
                 <encrypt>encrypt</encrypt>
+                <dane>dane</dane>
             </OptionValues>
         </smtpclient_security>
         <relayhost type="TextField">
diff --git a/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf b/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf
index c4de83da0..66ccd2b11 100644
--- a/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf
+++ b/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf
@@ -89,6 +89,9 @@ smtp_tls_wrappermode = yes
 {% endif %}
 
 {% if helpers.exists('OPNsense.postfix.general.smtpclient_security') and OPNsense.postfix.general.smtpclient_security != '' %}
+{% if OPNsense.postfix.general.smtpclient_security == 'dane' %}
+smtp_dns_support_level = dnssec
+{% endif %}
 smtp_tls_security_level = {{ OPNsense.postfix.general.smtpclient_security }}
 smtp_tls_loglevel = 1
 {% endif %}