mixandClaude Opus 5.5
f1d90a2a1b
test / test (push) Waiting to run
The security documentation's last open item of panel-dkim-signing (the owner's decision, 2026-10-16): go-milter v0.4.1 added every header of a session to a map of its own, emptied only on ABORT, and handed it to Headers - which no milter of the panel reads. Postfix bounds one header, not their number, so a message of nothing but headers up to the message size limit was held whole by the library in the sender check, the signer and the journal milter on 465/587 and in the inbound journal milter on port 25, where strangers send; the signer's 1 MiB refusal came after it was all in. third_party/go-milter is v0.4.1 from the module cache (BSD 2-Clause, LICENSE kept) with session.go changed: CodeHeader hands the header to Header and keeps nothing, CodeEOH hands Headers an empty map. PATCHES.md says what and why, and how to take a new upstream version. go.mod replaces the module with it; the Dockerfile copies third_party before "go mod download". TestTheLibraryKeepsNoHeaders holds it through the library's own client over two messages of one connection. Comments, security.md (the accepted risk becomes a note), development.md's library table, the plan and CHANGELOG follow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
69 lines
1.8 KiB
Go
69 lines
1.8 KiB
Go
package milter
|
|
|
|
// Message represents a command sent from milter client
|
|
type Message struct {
|
|
Code byte
|
|
Data []byte
|
|
}
|
|
|
|
type ActionCode byte
|
|
|
|
const (
|
|
ActAccept ActionCode = 'a' // SMFIR_ACCEPT
|
|
ActContinue ActionCode = 'c' // SMFIR_CONTINUE
|
|
ActDiscard ActionCode = 'd' // SMFIR_DISCARD
|
|
ActReject ActionCode = 'r' // SMFIR_REJECT
|
|
ActTempFail ActionCode = 't' // SMFIR_TEMPFAIL
|
|
ActReplyCode ActionCode = 'y' // SMFIR_REPLYCODE
|
|
|
|
// [v6]
|
|
ActSkip ActionCode = 's' // SMFIR_SKIP
|
|
)
|
|
|
|
type ModifyActCode byte
|
|
|
|
const (
|
|
ActAddRcpt ModifyActCode = '+' // SMFIR_ADDRCPT
|
|
ActDelRcpt ModifyActCode = '-' // SMFIR_DELRCPT
|
|
ActReplBody ModifyActCode = 'b' // SMFIR_ACCEPT
|
|
ActAddHeader ModifyActCode = 'h' // SMFIR_ADDHEADER
|
|
ActChangeHeader ModifyActCode = 'm' // SMFIR_CHGHEADER
|
|
ActInsertHeader ModifyActCode = 'i' // SMFIR_INSHEADER
|
|
ActQuarantine ModifyActCode = 'q' // SMFIR_QUARANTINE
|
|
|
|
// [v6]
|
|
ActChangeFrom ModifyActCode = 'e' // SMFIR_CHGFROM
|
|
)
|
|
|
|
type Code byte
|
|
|
|
const (
|
|
CodeOptNeg Code = 'O' // SMFIC_OPTNEG
|
|
CodeMacro Code = 'D' // SMFIC_MACRO
|
|
CodeConn Code = 'C' // SMFIC_CONNECT
|
|
CodeQuit Code = 'Q' // SMFIC_QUIT
|
|
CodeHelo Code = 'H' // SMFIC_HELO
|
|
CodeMail Code = 'M' // SMFIC_MAIL
|
|
CodeRcpt Code = 'R' // SMFIC_RCPT
|
|
CodeHeader Code = 'L' // SMFIC_HEADER
|
|
CodeEOH Code = 'N' // SMFIC_EOH
|
|
CodeBody Code = 'B' // SMFIC_BODY
|
|
CodeEOB Code = 'E' // SMFIC_BODYEOB
|
|
CodeAbort Code = 'A' // SMFIC_ABORT
|
|
CodeData Code = 'T' // SMFIC_DATA
|
|
|
|
// [v6]
|
|
CodeQuitNewConn Code = 'K' // SMFIC_QUIT_NC
|
|
)
|
|
|
|
const MaxBodyChunk = 65535
|
|
|
|
type ProtoFamily byte
|
|
|
|
const (
|
|
FamilyUnknown ProtoFamily = 'U' // SMFIA_UNKNOWN
|
|
FamilyUnix ProtoFamily = 'L' // SMFIA_UNIX
|
|
FamilyInet ProtoFamily = '4' // SMFIA_INET
|
|
FamilyInet6 ProtoFamily = '6' // SMFIA_INET6
|
|
)
|