panel-dkim-signing: the queue by name, and findings of the reviews

The first rollout of faa3c11 to the test server crash-looped: without
opendkim the image's package accounts got other numbers (postfix 101 ->
100, postdrop 103 -> 102), the queue under /data kept the old ones, and
postsuper, which "postfix check" runs as the mail owner
(src/postsuper/postsuper.c:1442), could not open it. Rolled back within
five minutes. The entrypoint now hands an existing queue to Postfix's users
by name before postfix-config.sh, and again after it (own_queue).

Technical review (F1-F10):
- F1 high: a backup of an upgraded installation carried /data/opendkim, a
  restore left it root's, and the panel refused every start. The tree is
  left out of archives, and the entrypoint makes it the panel's alone
  (0700/0600; also the security review's F3 - nothing of 2.8 needs the
  group any more; a 2.7.x start re-normalises it).
- F2: List-Unsubscribe-Post is signed (RFC 8058); Sender too (security F1).
- F3: SetServerName keeps the name in lower case - a key written under
  "Mail.Example.com" was never found. Only the DKIM side: the SASL realm
  is compared as written.
- F4: the signer rewrites the selector table at every start
  (WriteSelectors, replacing EnsureServerSigned), and tries again every
  10 s while a rewrite fails.
- F5: e2e signature_over_awkward_headers (folded, tab-led, no space, two
  To:, 8-bit body, List-Unsubscribe-Post) checked by dkimpy;
  TestStartsOnA27Data starts on a 2.7 /data (old key tree, a queue of
  foreign numbers) and checks the copied key signs, the old tree's modes
  and the queue's owners; unit tests for repeated headers and the header
  limit.
- F6: the table's writers are serialised (tableMu).
- F7: the table is read for every message; keys the table no longer names
  are dropped from memory.
- F8: the signature's value brings its own space (SMFIP_HDR_LEADSPC gets
  none from Postfix, cleanup_milter.c:1085).
- F9: a body line over 998 bytes is logged with its domain: Postfix's SMTP
  client breaks it after signing (smtp_proto.c:1266-1274).
- F10: the keys are copied while /data/dkim holds none (not only when it
  is absent), after the old tree is made the panel's (an install from 2.6
  had another uid); the plan's rollback note says what a rollback keeps.

Security review: F2 a header section over 1 MiB is refused (552 5.3.4)
and the kept headers freed once the block is built - fifty connections of
header-only messages could take the panel down; F5 the shown headers a
message has (Subject, Date, To, Cc, Reply-To, Sender) are over-signed,
only when present, since cleanup adds a missing Date: after the milters.
F1 (holding Sender: to the login like From:) changes what is refused and
waits for the owner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/domain/keys.go

@@ -167,27 +167,6 @@ func (o *Keys) Rebuild(domains []SigningDomain) error {
 	return writeFileAtomic(o.selectorsPath, table, 0o600)
 }
 
-// signs reports whether the selector table signs name with the key of
-// selector. A table that does not exist yet signs nothing. The selector is
-// part of the question because the panel shows and checks the record of one
-// key; a table that names another would have the signer sign with a key whose
-// record nobody is told to publish.
-func (o *Keys) signs(name, selector string) (bool, error) {
-	data, err := os.ReadFile(o.selectorsPath)
-	if os.IsNotExist(err) {
-		return false, nil
-	}
-	if err != nil {
-		return false, fmt.Errorf("read %s: %w", filepath.Base(o.selectorsPath), err)
-	}
-	for _, line := range strings.Split(string(data), "\n") {
-		if line == name+" "+selector {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
 // renderSelectors builds the selector table for a domain set, a line
 // "<name> <selector>" each, sorted by name so the output is deterministic.
 // Every domain is re-checked for config-injection safety before being written

internal/domain/keys_test.go

@@ -91,11 +91,8 @@ func TestRebuildWritesThePanelsOwnFiles(t *testing.T) {
 	if err := o.Rebuild([]SigningDomain{{Name: "example.com", Selector: "selfpost"}}); err != nil {
 		t.Fatalf("Rebuild: %v", err)
 	}
-	if signed, err := o.signs("example.com", "selfpost"); err != nil || !signed {
-		t.Errorf("signs after Rebuild = %v, %v", signed, err)
-	}
-	if signed, err := o.signs("example.com", "other"); err != nil || signed {
-		t.Errorf("signs with another selector = %v, %v", signed, err)
+	if got, err := os.ReadFile(o.selectorsPath); err != nil || string(got) != "example.com selfpost"+"\n" {
+		t.Errorf("selector table after Rebuild = %q, %v", got, err)
 	}
 	if runtime.GOOS == "windows" {
 		return // no Unix modes

internal/domain/servermail_test.go

@@ -82,10 +82,10 @@ func TestServerNameThatIsAlsoADomain(t *testing.T) {
 	}
 }
 
-// The first start of 2.8.0 finds no selector table - OpenDKIM's tables were
-// the earlier versions' - and an installation may lack the server's line.
-// The start rebuilds, once.
-func TestEnsureServerSignedRebuildsOnce(t *testing.T) {
+// The signer rewrites the table at every start: the first start of 2.8.0
+// finds none (OpenDKIM's tables were the earlier versions'), and a rewrite
+// cut short leaves a domain without its line while the server's is there.
+func TestWriteSelectorsAtTheStart(t *testing.T) {
 	svc, keys := newTestService(t, &fakeApps{})
 	if _, err := svc.Add("example.com"); err != nil {
 		t.Fatal(err)
@@ -95,43 +95,51 @@ func TestEnsureServerSignedRebuildsOnce(t *testing.T) {
 	}
 
 	svc.SetServerName("mail.example.org")
-	if rebuilt, err := svc.EnsureServerSigned(); err != nil || !rebuilt {
-		t.Fatalf("first start: rebuilt = %v, %v; want a rebuild", rebuilt, err)
+	if err := svc.WriteSelectors(); err != nil {
+		t.Fatalf("first start: %v", err)
 	}
-	if got, want := readSelectors(t, keys), "example.com selfpost\nmail.example.org selfpost\n"; got != want {
-		t.Errorf("selector table after the rebuild = %q, want %q", got, want)
+	want := "example.com selfpost" + "\n" + "mail.example.org selfpost" + "\n"
+	if got := readSelectors(t, keys); got != want {
+		t.Errorf("selector table after the first start = %q, want %q", got, want)
 	}
-	if rebuilt, err := svc.EnsureServerSigned(); err != nil || rebuilt {
-		t.Errorf("second start: rebuilt = %v, %v; want nothing to do", rebuilt, err)
+
+	// A domain's line lost (a rewrite cut short): the next start puts it back.
+	if err := os.WriteFile(keys.selectorsPath, []byte("mail.example.org selfpost"+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := svc.WriteSelectors(); err != nil {
+		t.Fatal(err)
+	}
+	if got := readSelectors(t, keys); got != want {
+		t.Errorf("selector table after the next start = %q, want %q", got, want)
 	}
 
 	// A name that only begins like the server's is not it.
 	other, otherKeys := newTestService(t, &fakeApps{})
 	other.SetServerName("mail.example.org.evil.example")
-	if _, err := other.EnsureServerSigned(); err != nil {
+	if err := other.WriteSelectors(); err != nil {
 		t.Fatal(err)
 	}
-	if signed, err := otherKeys.signs("mail.example.org", "selfpost"); err != nil || signed {
-		t.Errorf("a longer name was taken for the server's: %v, %v", signed, err)
+	if got := readSelectors(t, otherKeys); got != "mail.example.org.evil.example selfpost"+"\n" {
+		t.Errorf("selector table = %q", got)
 	}
 }
 
-// A table that signs the server's name with the key of another selector - the
-// default selector was changed - is rebuilt: the signer must sign with the key
-// whose record the panel shows.
-func TestEnsureServerSignedFollowsTheSelector(t *testing.T) {
+// A changed default selector: the server's name is signed with the key of the
+// new one, whose record the panel shows.
+func TestWriteSelectorsFollowsTheSelector(t *testing.T) {
 	svc, keys := newTestService(t, &fakeApps{})
 	svc.SetServerName("mail.example.org")
-	if _, err := svc.EnsureServerSigned(); err != nil {
+	if err := svc.WriteSelectors(); err != nil {
 		t.Fatal(err)
 	}
 
 	svc.selector = "sp2027"
-	if rebuilt, err := svc.EnsureServerSigned(); err != nil || !rebuilt {
-		t.Fatalf("after the selector changed: rebuilt = %v, %v; want a rebuild", rebuilt, err)
+	if err := svc.WriteSelectors(); err != nil {
+		t.Fatal(err)
 	}
-	if got := readSelectors(t, keys); got != "mail.example.org sp2027\n" {
-		t.Errorf("selector table after the rebuild = %q", got)
+	if got := readSelectors(t, keys); got != "mail.example.org sp2027"+"\n" {
+		t.Errorf("selector table after the change = %q", got)
 	}
 	mail, err := svc.ServerMail()
 	if err != nil || mail.Selector != "sp2027" {
@@ -139,6 +147,26 @@ func TestEnsureServerSignedFollowsTheSelector(t *testing.T) {
 	}
 }
 
+// A hostname written with capitals is the server's name in lower case: the
+// signer looks a key up by the name in lower case, and a key written under the
+// capitals would never be found.
+func TestServerNameInCapitals(t *testing.T) {
+	svc, keys := newTestService(t, &fakeApps{})
+	svc.SetServerName("Mail.Example.ORG")
+	if err := svc.WriteSelectors(); err != nil {
+		t.Fatal(err)
+	}
+	if got := readSelectors(t, keys); got != "mail.example.org selfpost"+"\n" {
+		t.Errorf("selector table = %q", got)
+	}
+	if _, err := os.Stat(KeyPath(keys.keysDir, "mail.example.org", "selfpost")); err != nil {
+		t.Errorf("the key is not under the name in lower case: %v", err)
+	}
+	if mail, err := svc.ServerMail(); err != nil || mail.Name != "mail.example.org" {
+		t.Errorf("server mail = %+v, %v", mail, err)
+	}
+}
+
 // Without a hostname nothing is added and nothing is signed for it.
 func TestNoServerName(t *testing.T) {
 	svc, keys := newTestService(t, &fakeApps{})

internal/domain/service.go

@@ -3,6 +3,8 @@ package domain
 import (
 	"errors"
 	"fmt"
+	"strings"
+	"sync"
 
 	"github.com/mixeme/selfpost/internal/store"
 )
@@ -50,9 +52,13 @@ type Service struct {
 // them the name is signed like a sending domain: it gets a DKIM key and a line
 // in the selector table, without being a row of the registry - no application
 // can send as it. The name comes from SELFPOST_HOSTNAME, which the entrypoint
-// has validated; it is not user input.
+// has validated; it is not user input. It is kept in lower case, as every
+// domain is (validate.NormalizeDomain): the signer finds a key by the name in
+// lower case (internal/milter, SignKeys), and a key written under
+// "Mail.Example.com" would never be found. Only the DKIM side lowers it - the
+// SASL realm, which defaults to the hostname, is compared as written.
 func (s *Service) SetServerName(hostname string) {
-	s.serverName = hostname
+	s.serverName = strings.ToLower(hostname)
 }
 
 // ServerMail is how the server's own name is signed.
@@ -84,29 +90,16 @@ func (s *Service) ServerMail() (ServerMail, error) {
 	return ServerMail{Name: s.serverName, Selector: selector, Record: rec}, nil
 }
 
-// EnsureServerSigned makes sure the selector table has the line for the
-// server's own name, rebuilding it if it does not - or if there is no table
-// yet, as on the first start of 2.8.0, whose table replaced OpenDKIM's. The
-// table is otherwise rebuilt only when a domain is added or deleted, so an
-// installation whose DKIM_SELECTOR_DEFAULT was changed would go on signing
-// with the key of the old selector while the panel shows the record of the
-// new. It reports whether it had to rebuild.
-func (s *Service) EnsureServerSigned() (bool, error) {
-	if s.serverName == "" {
-		return false, nil
-	}
-	selector, err := s.serverSelector()
-	if err != nil {
-		return false, err
-	}
-	signed, err := s.keys.signs(s.serverName, selector)
-	if err != nil {
-		return false, err
-	}
-	if signed {
-		return false, nil
-	}
-	return true, s.resync()
+// WriteSelectors rewrites the selector table from the registry. The signer
+// calls it before it serves (cmd/panel/signer.go): the table is otherwise
+// rewritten only when a domain is added, deleted or imported, by Reload
+// configuration and after a restore, so a start would leave it out of step
+// after a rewrite that was cut short (a panel killed between a domain's row
+// and its line), after a changed DKIM_SELECTOR_DEFAULT (the server's name
+// would be signed with the old selector's key while the panel shows the new
+// record), and on the first start of 2.8.0, which has no table yet.
+func (s *Service) WriteSelectors() error {
+	return s.resync()
 }
 
 // serverSelector is the selector the server's own name is signed with: that of
@@ -297,8 +290,17 @@ func (s *Service) Resync() error {
 	return nil
 }
 
+// tableMu orders the selector table's writers. Each role builds a Service of
+// its own (cmd/panel, newMailStack), and a rewrite is a read of the registry
+// and then a write: without it, a writer that read before another's domain
+// was added could write after it, and the table would lack that domain until
+// the next rewrite.
+var tableMu sync.Mutex
+
 // resync rebuilds the selector table from the current domain set.
 func (s *Service) resync() error {
+	tableMu.Lock()
+	defer tableMu.Unlock()
 	domains, err := s.store.ListDomains()
 	if err != nil {
 		return err