panel-dkim-signing: the queue by name, and findings of the reviews

The first rollout of faa3c11 to the test server crash-looped: without
opendkim the image's package accounts got other numbers (postfix 101 ->
100, postdrop 103 -> 102), the queue under /data kept the old ones, and
postsuper, which "postfix check" runs as the mail owner
(src/postsuper/postsuper.c:1442), could not open it. Rolled back within
five minutes. The entrypoint now hands an existing queue to Postfix's users
by name before postfix-config.sh, and again after it (own_queue).

Technical review (F1-F10):
- F1 high: a backup of an upgraded installation carried /data/opendkim, a
  restore left it root's, and the panel refused every start. The tree is
  left out of archives, and the entrypoint makes it the panel's alone
  (0700/0600; also the security review's F3 - nothing of 2.8 needs the
  group any more; a 2.7.x start re-normalises it).
- F2: List-Unsubscribe-Post is signed (RFC 8058); Sender too (security F1).
- F3: SetServerName keeps the name in lower case - a key written under
  "Mail.Example.com" was never found. Only the DKIM side: the SASL realm
  is compared as written.
- F4: the signer rewrites the selector table at every start
  (WriteSelectors, replacing EnsureServerSigned), and tries again every
  10 s while a rewrite fails.
- F5: e2e signature_over_awkward_headers (folded, tab-led, no space, two
  To:, 8-bit body, List-Unsubscribe-Post) checked by dkimpy;
  TestStartsOnA27Data starts on a 2.7 /data (old key tree, a queue of
  foreign numbers) and checks the copied key signs, the old tree's modes
  and the queue's owners; unit tests for repeated headers and the header
  limit.
- F6: the table's writers are serialised (tableMu).
- F7: the table is read for every message; keys the table no longer names
  are dropped from memory.
- F8: the signature's value brings its own space (SMFIP_HDR_LEADSPC gets
  none from Postfix, cleanup_milter.c:1085).
- F9: a body line over 998 bytes is logged with its domain: Postfix's SMTP
  client breaks it after signing (smtp_proto.c:1266-1274).
- F10: the keys are copied while /data/dkim holds none (not only when it
  is absent), after the old tree is made the panel's (an install from 2.6
  had another uid); the plan's rollback note says what a rollback keeps.

Security review: F2 a header section over 1 MiB is refused (552 5.3.4)
and the kept headers freed once the block is built - fifty connections of
header-only messages could take the panel down; F5 the shown headers a
message has (Subject, Date, To, Cc, Reply-To, Sender) are over-signed,
only when present, since cleanup adds a missing Date: after the milters.
F1 (holding Sender: to the login like From:) changes what is refused and
waits for the owner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/milter/sign_test.go

@@ -136,11 +136,14 @@ func sendMessage(t *testing.T, s *milter.ClientSession, login string, headers []
 }
 
 // delivered is the message as Postfix delivers it with the signature
-// inserted at the top: every header line ending CRLF.
+// inserted at the top: every header line ending CRLF, and the signature as
+// "name:value" - its value brings its own space (Postfix 3.10.13,
+// src/cleanup/cleanup_milter.c:1085, "%s:%s%s" with no space for a milter
+// that asked for SMFIP_HDR_LEADSPC).
 func delivered(sig milter.ModifyAction, headers []field, body string) []byte {
 	var b bytes.Buffer
 	crlf := func(v string) string { return strings.ReplaceAll(v, "\n", "\r\n") }
-	b.WriteString(sig.HeaderName + ": " + crlf(sig.HeaderValue) + "\r\n")
+	b.WriteString(sig.HeaderName + ":" + crlf(sig.HeaderValue) + "\r\n")
 	for _, h := range headers {
 		b.WriteString(h.name + ":" + crlf(h.value) + "\r\n")
 	}
@@ -187,15 +190,28 @@ func TestSignerSignsWithTheLoginsDomain(t *testing.T) {
 	if v.Domain != "example.org" {
 		t.Errorf("d=%s, want example.org", v.Domain)
 	}
-	for _, want := range []string{"c=relaxed/simple", "s=sel", "h=From:To:Subject:Date:From"} {
-		if !strings.Contains(strings.ReplaceAll(sig.HeaderValue, "\n", ""), want) {
+	if !strings.HasPrefix(sig.HeaderValue, " ") {
+		t.Errorf("the signature's value does not bring its space: %q", sig.HeaderValue)
+	}
+	for _, want := range []string{"c=relaxed/simple;", "s=sel;", "h=From:To:Subject:Date:To:Subject:Date:From;"} {
+		if !strings.Contains(strings.Join(strings.Fields(sig.HeaderValue), ""), want) {
 			t.Errorf("signature lacks %q: %s", want, sig.HeaderValue)
 		}
 	}
-	// A second From: added on the way breaks it: From is over-signed.
-	tampered := append([]field{{"From", " Mallory <m@evil.example>"}}, testHeaders...)
-	if v := verifyWith(t, f.record, delivered(sig, tampered, testBody)); v.Err == nil {
-		t.Error("a From: added above still verifies")
+	// A second From:, Subject: or To: added on the way breaks it: each is
+	// over-signed.
+	for _, added := range []field{{"From", " Mallory <m@evil.example>"}, {"Subject", " urgent: wire the money"}, {"To", " victim@example.net"}} {
+		tampered := append([]field{added}, testHeaders...)
+		if v := verifyWith(t, f.record, delivered(sig, tampered, testBody)); v.Err == nil {
+			t.Errorf("a %s: added above still verifies", added.name)
+		}
+	}
+	// A Cc: the message had none of may be added: only what is present is
+	// over-signed, as Postfix's cleanup adds a missing Date: after the
+	// milters.
+	withCc := append([]field{{"Cc", " someone@example.net"}}, testHeaders...)
+	if v := verifyWith(t, f.record, delivered(sig, withCc, testBody)); v.Err != nil {
+		t.Errorf("a Cc: the message did not have breaks it: %v", v.Err)
 	}
 	// A changed body breaks it.
 	if v := verifyWith(t, f.record, delivered(sig, testHeaders, testBody+"more\r\n")); v.Err == nil {
@@ -297,10 +313,57 @@ func TestSignerDefersWhatItCannotSign(t *testing.T) {
 	}
 }
 
+// Two To: lines and the headers OpenDKIM's list left out verify as signed.
+func TestSignerSignsRepeatedHeaders(t *testing.T) {
+	f := newSignFixture(t)
+	s := startSigner(t, f, appDomains)
+	headers := []field{
+		{"From", " Alice <alice@example.org>"}, {"Sender", " list@example.org"},
+		{"To", " bob@example.net"}, {"To", " carol@example.net"}, {"Cc", " dave@example.net"},
+		{"Subject", " two To lines"},
+		{"List-Unsubscribe", " <https://example.org/u/1>"}, {"List-Unsubscribe-Post", " List-Unsubscribe=One-Click"},
+	}
+	sig := signed(t, s, "app1", headers, testBody)
+	if v := verifyWith(t, f.record, delivered(sig, headers, testBody)); v.Err != nil {
+		t.Fatalf("signature does not verify: %v", v.Err)
+	}
+	// The second To: changed: it was signed too.
+	changed := append([]field(nil), headers...)
+	changed[3] = field{"To", " mallory@example.net"}
+	if v := verifyWith(t, f.record, delivered(sig, changed, testBody)); v.Err == nil {
+		t.Error("a changed second To: still verifies")
+	}
+}
+
+// A header section past headerLimit is refused for good, before any key is
+// looked up, and nothing is inserted.
+func TestSignerRefusesAHugeHeaderSection(t *testing.T) {
+	f := newSignFixture(t)
+	s := startSigner(t, f, appDomains)
+	headers := []field{{"From", " Alice <alice@example.org>"}}
+	filler := strings.Repeat("x", 50000)
+	for i := 0; i*50000 < headerLimit; i++ {
+		headers = append(headers, field{"X-Filler", " " + filler})
+	}
+	mods, act := sendMessage(t, s, "app1", headers, testBody)
+	if act.Code != milter.ActReplyCode || act.SMTPCode != 552 || len(mods) != 0 {
+		t.Fatalf("got %+v with %d modifications, want a 552 reply and none", act, len(mods))
+	}
+}
+
 // signLines writes the block Postfix will deliver and names what is signed.
 func TestSignLines(t *testing.T) {
 	keys, block := signLines(testHeaders)
-	if got := strings.Join(keys, ":"); got != "From:To:Subject:Date:From" {
+	if got := strings.Join(keys, ":"); got != "From:To:Subject:Date:To:Subject:Date:From" {
+		t.Errorf("keys %s", got)
+	}
+	// Every occurrence is signed; a shown one is named once more, once.
+	keys, _ = signLines([]field{
+		{"From", " a@example.org"}, {"Sender", " b@example.org"}, {"To", " c@example.net"}, {"To", " d@example.net"},
+		{"List-Unsubscribe", " <https://example.org/u>"}, {"List-Unsubscribe-Post", " List-Unsubscribe=One-Click"},
+		{"X-Other", " not signed"},
+	})
+	if got := strings.Join(keys, ":"); got != "From:Sender:To:To:List-Unsubscribe:List-Unsubscribe-Post:Sender:To:From" {
 		t.Errorf("keys %s", got)
 	}
 	want := "From: Alice <alice@example.org>\r\nTo: bob@example.net\r\n" +