From: Andrea Pappacoda Subject: smtpd: improve mask-src behaviour To: tech@openbsd.org Date: Sun, 13 Sep 2026 03:53:57 +0200 This patch makes smtpd's mask-src option behave like Postfix's smtpd_hide_client_session parameter. i.e., the "with SMTP" part of the Received line is now stripped out as well. This is because RFC 5322 (describing the message format) says that a Received header can contain pretty much anything, while RFC 5321 says that if the message is being processed in an SMTP enviroment then the FROM clause *must* be present as well. Having a Received line saying "with SMTP" with no FROM is a contradiction. Hence, taking it out allows to only fulfill the laxer RFC 5322 format. This also fixes an issue where a blank line after "Received:" was printed instead of the from line when mask-src is active. Prompted from a discussion on the misc opensmtpd list. --- I didn't have the time to test this on my openbsd box, but it should be correct. usr.sbin/smtpd/smtp_session.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/usr.sbin/smtpd/smtp_session.c b/usr.sbin/smtpd/smtp_session.c index bc7d864fc54..3be3c6e2beb 100644 --- a/usr.sbin/smtpd/smtp_session.c +++ b/usr.sbin/smtpd/smtp_session.c @@ -2769,22 +2769,27 @@ smtp_message_begin(struct smtp_tx *tx) m_printf(tx, "Received: "); if (!(s->listener->flags & F_MASK_SOURCE)) { - m_printf(tx, "from %s (%s %s%s%s)", + m_printf(tx, "from %s (%s %s%s%s)\n\t", s->helo, s->rdns, s->ss.ss_family == AF_INET6 ? "" : "[", ss_to_text(&s->ss), s->ss.ss_family == AF_INET6 ? "" : "]"); } - m_printf(tx, "\n\tby %s (%s) with %sSMTP%s%s id %08x", + + m_printf(tx, "by %s (%s) ", s->smtpname, - SMTPD_NAME, - s->flags & SF_EHLO ? "E" : "", - s->flags & SF_SECURE ? "S" : "", - s->flags & SF_AUTHENTICATED ? "A" : "", - tx->msgid); + SMTPD_NAME); - if (s->flags & SF_SECURE) { + if (!(s->listener->flags & F_MASK_SOURCE)) { + m_printf(tx, "with %sSMTP%s%s ", + s->flags & SF_EHLO ? "E" : "", + s->flags & SF_SECURE ? "S" : "", + s->flags & SF_AUTHENTICATED ? "A" : ""); + } + m_printf(tx, "id %08x", tx->msgid); + + if (!(s->listener->flags & F_MASK_SOURCE) && s->flags & SF_SECURE) { m_printf(tx, " (%s:%s:%d:%s)", tls_conn_version(io_tls(s->io)), tls_conn_cipher(io_tls(s->io)), -- 2.53.0