From: Kirill A. Korinsky <kirill@korins.ky>
Subject: Re: smtpd: improve mask-src behaviour
To: Andrea Pappacoda <andrea@pappacoda.it>
Cc: tech@openbsd.org
Date: Sun, 13 Sep 2026 12:57:22 +0200

On Sun, 13 Sep 2026 03:53:57 +0200,
Andrea Pappacoda <andrea@pappacoda.it> wrote:
> 
> This patch makes smtpd's mask-src option behave like Postfix's
> smtpd_hide_client_session parameter. i.e., the "with SMTP" part of
> the Received line is now stripped out as well.
> 
> This is because RFC 5322 (describing the message format) says that a
> Received header can contain pretty much anything, while RFC 5321 says
> that if the message is being processed in an SMTP enviroment then the
> FROM clause *must* be present as well. Having a Received line saying
> "with SMTP" with no FROM is a contradiction. Hence, taking it out
> allows to only fulfill the laxer RFC 5322 format.
> 
> This also fixes an issue where a blank line after "Received:" was
> printed instead of the from line when mask-src is active.
> 
> Prompted from a discussion on the misc opensmtpd list.
> ---
> 
> I didn't have the time to test this on my openbsd box, but it should be 
> correct.
>

I actually tested it on my setup, and it works as expected:

Received: by mx1.catap.net (OpenSMTPD) id d9494ca0
	for <kirill@korins.ky>;
	Sun, 13 Sep 2026 12:55:12 +0200 (CEST)
Received: from localhost (matebook.home.arpa [local])
	by matebook.home.arpa (OpenSMTPD) with ESMTPA id 540e7ffa
	for <kirill@korins.ky>;
	Sun, 13 Sep 2026 12:55:10 +0200 (CEST)

I think it right things, so OK kirill@ if anyone willing to commit it.

>  usr.sbin/smtpd/smtp_session.c | 21 +++++++++++++--------
>  1 file changed, 13 insertions(+), 8 deletions(-)
> 
> diff --git a/usr.sbin/smtpd/smtp_session.c b/usr.sbin/smtpd/smtp_session.c
> index bc7d864fc54..3be3c6e2beb 100644
> --- a/usr.sbin/smtpd/smtp_session.c
> +++ b/usr.sbin/smtpd/smtp_session.c
> @@ -2769,22 +2769,27 @@ smtp_message_begin(struct smtp_tx *tx)
>  
>  	m_printf(tx, "Received: ");
>  	if (!(s->listener->flags & F_MASK_SOURCE)) {
> -		m_printf(tx, "from %s (%s %s%s%s)",
> +		m_printf(tx, "from %s (%s %s%s%s)\n\t",
>  		    s->helo,
>  		    s->rdns,
>  		    s->ss.ss_family == AF_INET6 ? "" : "[",
>  		    ss_to_text(&s->ss),
>  		    s->ss.ss_family == AF_INET6 ? "" : "]");
>  	}
> -	m_printf(tx, "\n\tby %s (%s) with %sSMTP%s%s id %08x",
> +
> +	m_printf(tx, "by %s (%s) ",
>  	    s->smtpname,
> -	    SMTPD_NAME,
> -	    s->flags & SF_EHLO ? "E" : "",
> -	    s->flags & SF_SECURE ? "S" : "",
> -	    s->flags & SF_AUTHENTICATED ? "A" : "",
> -	    tx->msgid);
> +	    SMTPD_NAME);
>  
> -	if (s->flags & SF_SECURE) {
> +	if (!(s->listener->flags & F_MASK_SOURCE)) {
> +		m_printf(tx, "with %sSMTP%s%s ",
> +		    s->flags & SF_EHLO ? "E" : "",
> +		    s->flags & SF_SECURE ? "S" : "",
> +		    s->flags & SF_AUTHENTICATED ? "A" : "");
> +	}
> +	m_printf(tx, "id %08x", tx->msgid);
> +
> +	if (!(s->listener->flags & F_MASK_SOURCE) && s->flags & SF_SECURE) {
>  		m_printf(tx, " (%s:%s:%d:%s)",
>  		    tls_conn_version(io_tls(s->io)),
>  		    tls_conn_cipher(io_tls(s->io)),
> -- 
> 2.53.0
> 

-- 
wbr, Kirill