from-header-binding: findings of the technical and security reviews

Both reviews were of c171fb5, read-only, given the code and questions.

Found by both, and the one that would have refused ordinary mail from the
first day: a folded From: line - what a mail library makes of a long display
name - did not parse and was refused with 550. The line is unfolded before it
is read. e2e sends one through Postfix now.

Technical (Opus)
- A display name in a charset Go does not convert (windows-1251, koi8-r) was
  refused: such a name is passed through unread, only the address is judged.
- The statistics ran between binding the socket and serving it, with a
  supervisorctl that has no timeout: they are kept beside the check now and
  nothing of them is waited for. A supervisorctl that fails is logged.
- The count of deferred mail followed smtpd's reject lines and so missed a
  check that stops answering in the middle of a message, where cleanup
  writes them: it is taken at Postfix's warning, the line that names the
  socket. The test line for that case had been invented with the wrong
  process; it is marked as composed from Postfix's source.
- A card whose figures could not be read showed zeros and "ok": dashes and
  "unknown".
- entrypoint removes the sockets a killed container left, which satisfied
  the wrapper's wait before the check was listening.
- Outside quoted strings the line may hold one "@" only - a rule that needs
  no knowledge of OpenDKIM's parser.
- Comments that still spoke of two sockets, or of a session replaced after a
  refusal; the limits of the cards layout on a phone, said where it is defined.

Security (Fable; no Critical or High)
- Another sender's name in an encoded display name passed the second look:
  the decoded name is looked at as well.
- A client could arm the deferred counter by sending the socket's name where
  Postfix quotes it in a warning: the two warnings are matched from their
  first word.
- A refused message wrote a row per recipient: one row, naming the first
  recipient and how many more.
- Docs: the check's lookup is stricter than Postfix's for address extensions
  and the case of logins, rather than "cannot disagree"; what a display name
  looks like to a person is not promised; the timeouts and the 454 at AUTH
  stated as they are; "messages" are connections turned away.

Left as found, in the plan: downtime that crosses midnight is booked on the
day of the restart; a message with the null envelope sender leaves a row
without a domain; a log read again after an unclean stop counts again.

Test server, this tree: go vet ok, go test 23 packages ok, make e2e ok (330 s).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/entrypoint.sh

@@ -142,8 +142,8 @@ chmod 2750 /data/log
 find /data/log -type f -exec chmod 0640 {} +
 
 # Milter socket directories. Postfix (user `postfix`) must actually CONNECT to
-# both milter sockets — OpenDKIM's and the panel's journal-milter — not just
-# probe them at start-up. The sockets are created by the opendkim and panel
+# the milter sockets — OpenDKIM's and the panel's — not just probe them at
+# start-up. The sockets are created by the opendkim and panel
 # users respectively, so bridge them to `postfix` through the shared `selfpost`
 # group: group-owned + setgid dirs mean each socket created inside inherits
 # group `selfpost`, and group-traversable (2750) lets postfix reach it. Without
@@ -153,6 +153,11 @@ mkdir -p /run/opendkim /run/selfpost
 chown opendkim:selfpost /run/opendkim
 chown panel:selfpost /run/selfpost
 chmod 2750 /run/opendkim /run/selfpost
+# A container that was killed leaves its sockets behind, and a file nobody
+# listens on would satisfy postfix-wrapper.sh's wait: Postfix would start
+# before the sender check does and defer mail until it is there. The check's
+# alive mark stays - it is how the downtime of a restart is told.
+rm -f /run/opendkim/*.sock /run/selfpost/*.sock
 
 # Generate the outbound-relay Postfix configuration from the environment (spec
 # 5). Kept out of the image build so cert paths, rate limits, hostname and the

build/postfix-config.sh

@@ -93,8 +93,9 @@ fi
 RATE_MSGS="${RATE_LIMIT_MESSAGES_PER_IP:-100}"
 RATE_WINDOW="${RATE_LIMIT_WINDOW_SECONDS:-3600}"
 
-# Milter sockets: OpenDKIM (signing, strict) and the panel journal-milter
-# (monitoring, fail-open). Fixed container paths, matched by postfix-wrapper.sh.
+# Milter sockets: OpenDKIM (signing, strict), the panel's sender check
+# (strict) and its journal-milter (monitoring, fail-open). Fixed container
+# paths, matched by postfix-wrapper.sh.
 OPENDKIM_SOCK="${OPENDKIM_SOCKET:-/run/opendkim/opendkim.sock}"
 JOURNAL_SOCK="${JOURNAL_MILTER_SOCKET:-/run/selfpost/journal.sock}"
 # The panel's sender check (the From: line against the login, strict).

build/postfix-wrapper.sh

@@ -9,8 +9,9 @@
 # timeout it exits non-zero WITHOUT starting Postfix, so supervisord/Docker see
 # an explicit startup failure instead of a relay running blind.
 #
-# This handles cold start only. Runtime milter failures after a successful start
-# are governed by fail-open (milter_default_action).
+# This handles cold start only. Once Postfix runs, a milter that does not
+# answer costs what its default_action says (build/postfix-config.sh): mail is
+# deferred for OpenDKIM and the sender check, and passes the journal-milter.
 set -eu
 
 OPENDKIM_SOCK="${OPENDKIM_SOCKET:-/run/opendkim/opendkim.sock}"

build/supervisord.conf

@@ -1,8 +1,9 @@
 ; SelfPost process supervision.
 ;
 ; Start ORDER is enforced by priority=: OpenDKIM, then the panel (which opens
-; the journal-milter socket), then the Postfix wrapper — which additionally
-; blocks until both milter sockets are ready before starting Postfix.
+; the sender check's and the journal-milter's sockets), then the Postfix
+; wrapper — which additionally blocks until the milter sockets are ready
+; before starting Postfix.
 ;
 ; If any managed process exhausts its restart retries (FATAL), the crashexit
 ; event listener brings the whole container down so Docker's restart policy can