panel-dkim-signing stage 1: the panel's DKIM signer, beside OpenDKIM
internal/milter/sign.go: a milter on two sockets (cmd/panel/signer.go): sign.sock for 465/587, the key of the domain the SASL login belongs to (Bindings.DomainOf, the sender_login_maps Postfix reads), and sign-local.sock for the panel's own sendmail(1) mail, the server's name. go-msgauth/dkim v0.7.0, relaxed/simple, OpenDKIM's dkim_should_signhdrs[] (libopendkim/dkim.c:223-246) in message order plus From once more; keys and selectors from the KeyTable the panel writes, a key path outside the key directory refused; strict - whatever cannot be signed is deferred. From the sources: Postfix 3.10.13 milter8.c:2329-2400 hands a folded header \n-separated, so the signer joins its lines with CRLF; inserts are 1-based in cleanup_ins_header() (cleanup_milter.c:1193), so index 0 is the top, where OpenDKIM puts its own (opendkim.c:3673). go-milter v0.4.1 calls no Abort when a connection ends, so a watchdog closes go-msgauth's streaming signer after an hour and a late end of message is deferred. Postfix: smtpd_milters = sender check, signer, OpenDKIM, journal; non_smtpd_milters = the signer's local socket, OpenDKIM - both sign every message until stage 2. disable_mime_output_conversion=yes (default off, mail_params.h:3088): an 8-bit message is no longer re-encoded after it is signed. Tests: unit tests sign and verify folded, tab-led and space-free headers, an added From:, a changed body, two messages on a connection, odd bodies, and five cases deferred. e2e: the sink image has python3-dkim (dkimpy 1.1.8-2) and the stand's DNS; on an application's message and on a notification the two signatures must agree on h=, bh=, c=, s=, a= and each must pass dkimverify. On the server: make e2e exit 0 (714 s), go vet + go test 27 packages ok. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
+26
-5
@@ -185,6 +185,11 @@ OPENDKIM_SOCK="${OPENDKIM_SOCKET:-/run/opendkim/opendkim.sock}"
|
||||
JOURNAL_SOCK="${JOURNAL_MILTER_SOCKET:-/run/selfpost/journal.sock}"
|
||||
# The panel's sender check (the From: line against the login, strict).
|
||||
SENDER_SOCK="${SENDER_CHECK_SOCKET:-/run/selfpost/sender.sock}"
|
||||
# The panel's DKIM signer (strict): applications' mail, signed with the key
|
||||
# of the login's domain, and the panel's own, with the server's name's
|
||||
# (cmd/panel/signer.go). Matched by postfix-wrapper.sh.
|
||||
SIGN_SOCK="${DKIM_SIGN_SOCKET:-/run/selfpost/sign.sock}"
|
||||
SIGN_LOCAL_SOCK="${DKIM_SIGN_LOCAL_SOCKET:-/run/selfpost/sign-local.sock}"
|
||||
|
||||
# Persistent panel-managed sender map; texthash needs no postmap, so the
|
||||
# unprivileged panel can rewrite it and just ask for a reload. Postfix 3.10.13,
|
||||
@@ -405,10 +410,16 @@ postconf -e \
|
||||
# message it could not judge must not reach the signer. While the panel does
|
||||
# not answer on that socket, mail is deferred (docs/security.md).
|
||||
#
|
||||
# The panel's DKIM signer follows the sender check, strict too
|
||||
# (docs/plans/panel-dkim-signing.md). Until OpenDKIM leaves the image both
|
||||
# sign (stage 1 of that plan): OpenDKIM after the panel, so that every
|
||||
# message carries both signatures and the e2e suite compares them.
|
||||
#
|
||||
# non_smtpd_milters is the chain for mail submitted locally with sendmail(1) -
|
||||
# the panel's own notifications, sent as postmaster@ the hostname. OpenDKIM
|
||||
# signs them with the key of the server's own name; the journal-milter is not
|
||||
# on this chain, since they are not an application's mail. Bounces Postfix
|
||||
# the panel's own notifications, sent as postmaster@ the hostname. The
|
||||
# signer's own socket for it, and OpenDKIM, sign them with the key of the
|
||||
# server's own name; the journal-milter is not on this chain, since they are
|
||||
# not an application's mail. Bounces Postfix
|
||||
# generates itself do not pass it (internal_mail_filter_classes is empty).
|
||||
#
|
||||
# Postfix 3.10.13: html/MILTER_README.html:584, "Different settings for different
|
||||
@@ -420,8 +431,18 @@ postconf -e \
|
||||
postconf -e \
|
||||
"milter_protocol=6" \
|
||||
"milter_default_action=tempfail" \
|
||||
"smtpd_milters={ unix:${SENDER_SOCK}, default_action=tempfail }, { unix:${OPENDKIM_SOCK}, default_action=tempfail }, { unix:${JOURNAL_SOCK}, default_action=accept }" \
|
||||
"non_smtpd_milters={ unix:${OPENDKIM_SOCK}, default_action=tempfail }"
|
||||
"smtpd_milters={ unix:${SENDER_SOCK}, default_action=tempfail }, { unix:${SIGN_SOCK}, default_action=tempfail }, { unix:${OPENDKIM_SOCK}, default_action=tempfail }, { unix:${JOURNAL_SOCK}, default_action=accept }" \
|
||||
"non_smtpd_milters={ unix:${SIGN_LOCAL_SOCK}, default_action=tempfail }, { unix:${OPENDKIM_SOCK}, default_action=tempfail }"
|
||||
|
||||
# A signed message is delivered as it was signed: Postfix's SMTP client would
|
||||
# otherwise rewrite an 8-bit message as quoted-printable for a server that
|
||||
# does not announce 8BITMIME, and every body hash over it would fail.
|
||||
# Postfix 3.10.13, src/global/mail_params.h:3088, DEF_DISABLE_MIME_OCONV 0
|
||||
# (the conversion is on by default); proto/postconf.proto:7992,
|
||||
# disable_mime_output_conversion: "Disable the conversion of 8BITMIME format
|
||||
# to 7BIT format". Not set until 2.8.0 - OpenDKIM's signatures were exposed
|
||||
# to it as well.
|
||||
postconf -e "disable_mime_output_conversion=yes"
|
||||
|
||||
# What Postfix tells a milter with MAIL FROM: its defaults plus the client's
|
||||
# address. The panel's milters judge every message by that address (an
|
||||
|
||||
@@ -2,8 +2,9 @@
|
||||
# Postfix start wrapper: solves the cold-start race where Postfix would try to
|
||||
# reach the milter sockets before they are listening.
|
||||
#
|
||||
# It blocks until the milter sockets — OpenDKIM, the panel's sender check and
|
||||
# journal-milter and, with the inbound relay on, its inbound journal milter —
|
||||
# It blocks until the milter sockets — OpenDKIM, the panel's sender check,
|
||||
# DKIM signer (two) and journal-milter and, with the inbound relay on, its
|
||||
# inbound journal milter —
|
||||
# are present, then runs `postfix start-fg` and stays its parent. If they are
|
||||
# not ready within the timeout it exits non-zero WITHOUT starting Postfix.
|
||||
# supervisord counts that exit as one that came too quickly - the program's
|
||||
@@ -22,10 +23,12 @@ set -eu
|
||||
OPENDKIM_SOCK="${OPENDKIM_SOCKET:-/run/opendkim/opendkim.sock}"
|
||||
JOURNAL_SOCK="${JOURNAL_MILTER_SOCKET:-/run/selfpost/journal.sock}"
|
||||
SENDER_SOCK="${SENDER_CHECK_SOCKET:-/run/selfpost/sender.sock}"
|
||||
SIGN_SOCK="${DKIM_SIGN_SOCKET:-/run/selfpost/sign.sock}"
|
||||
SIGN_LOCAL_SOCK="${DKIM_SIGN_LOCAL_SOCKET:-/run/selfpost/sign-local.sock}"
|
||||
TIMEOUT="${MILTER_WAIT_TIMEOUT:-30}"
|
||||
INTERVAL=1
|
||||
|
||||
SOCKS="$OPENDKIM_SOCK $JOURNAL_SOCK $SENDER_SOCK"
|
||||
SOCKS="$OPENDKIM_SOCK $JOURNAL_SOCK $SENDER_SOCK $SIGN_SOCK $SIGN_LOCAL_SOCK"
|
||||
if [ "${INBOUND_RELAY_ENABLE:-false}" = "true" ]; then
|
||||
SOCKS="$SOCKS ${INBOUND_JOURNAL_MILTER_SOCKET:-/run/selfpost/inbound-journal.sock}"
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user