mixandClaude Opus 5.5
ecfe23504e
Security audit 2026-10-17, finding S4 (low), stage 4. The sidecar ran
rspamd 3.11.1 (December 2024) with default capabilities; upstream is 4.2.2
(2026-10-10), and the line between fixed a heap overflow in
util.lower_utf8, a use-after-free on reload and parser crashes - rspamd
reads every byte a stranger sends to port 25.
A read-only reading of rspamd 3.11.1 and 4.2.2 and of rspamd-docker
v3.11.1+3 and v4.2.2+0, side by side (sources in dev/upstream), found every
function SelfPost relies on unchanged: milter_headers (skip_wanted, the
custom routine, remove 0, create_specific_keyed, get_queue_id from {i}),
the X-Spamd-Result text, multimap (from/smtp, ip, the reject pre-result,
file-map rereading), the image's uid 11333 and CMD. It also found that the
image binds the normal worker (which takes client-named file and shm
inputs) and the controller (default password "q1") on every address,
reachable from any container on the compose network - so:
- image rspamd/rspamd:4.2.2-0 (the one build of 4.2.2; the others float);
- cap_drop: [ALL], no-new-privileges (rspamd starts unprivileged, ports
above 1024, nothing setuid);
- RSPAMD_LOCAL_ADDR=localhost keeps every worker on loopback, and a new
antispam/rspamd/worker-proxy.inc puts the proxy alone on *:11332. rspamd
expands its template syntax in comments too - the first version of that
comment quoted it and the config failed to load; it quotes none now.
Checked in a throwaway container on the test server with the three files
and the fragment's options (dev/server/rspamd-try.sh): proxy on any
address, 11333/11334 on loopback; from a private address a sender's own
verdict headers removed and rspamd's added; X-SelfPost-Filter equal to
openssl's HMAC-SHA256 of the queue id; a denied address refused with the
deny list's message; healthy. The e2e has no rspamd; the live sidecar is
checked at the rollout. Citations re-pointed to 4.2.2.
Docs: guide § Inbound relay (the third file; copy antispam/ again);
CHANGELOG; plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
78 lines
4.0 KiB
Plaintext
78 lines
4.0 KiB
Plaintext
# Mounted into the sidecar as /etc/rspamd/local.d/milter_headers.conf.
|
|
#
|
|
# rspamd writes its verdict into two headers of every message it lets through:
|
|
# the action it chose and the score with the symbols behind it. SelfPost's
|
|
# inbound journal reads them (Inbound > Log shows them next to the message),
|
|
# and the upstream mailbox server receives them with the mail.
|
|
#
|
|
# rspamd removes headers of these names that a sender wrote himself before it
|
|
# adds its own - for every client, because of the two lines below. Without
|
|
# them it would do neither for a client it counts as local or one that
|
|
# authenticated: rspamd 4.2.2 (as 3.11.1), src/plugins/lua/milter_headers.lua,
|
|
# skip_wanted() - skip_local and skip_authenticated are on by default, and
|
|
# "local" is loopback, a unix socket, or an address in local_addrs, the
|
|
# private ranges (src/lua/lua_ip.c, lua_ip_is_local(); conf/options.inc). The
|
|
# sender's own verdict would then pass untouched while the signature below,
|
|
# a custom routine that skip_wanted() never consults, signed it (assumptions
|
|
# C-R7). A private client address is ordinary here: a LAN sender, or every
|
|
# sender when Docker's proxy relays port 25 from the bridge gateway.
|
|
# Tried on 2026-10-14 in a throwaway rspamd/rspamd:3.11.1-3 (rspamc --ucl, a
|
|
# message carrying its own X-Spamd-Result and X-Rspamd-Action): without the
|
|
# two lines, from 10.0.0.5 or as an authenticated user, the milter reply
|
|
# removed neither header, added neither, and added the signature; with
|
|
# them, both removed and rspamd's own added, as from a public address. The
|
|
# same again on 2026-10-17 in rspamd/rspamd:4.2.2-0 (from 10.0.0.5), and the
|
|
# signature equal to HMAC-SHA256 of the queue id computed with openssl.
|
|
#
|
|
# Without this file the journal still lists accepted mail, with no verdict
|
|
# next to it.
|
|
#
|
|
# The third header is the proof that the other two are rspamd's. The filter is
|
|
# attached so that mail still flows when it is down, and then nothing removes
|
|
# what a sender wrote: he could send his own verdict. So rspamd signs each
|
|
# message - an HMAC-SHA256 of the message's queue id under a key SelfPost
|
|
# generates and leaves in the directory it shares with this container - and
|
|
# SelfPost reads a verdict only next to a signature it can recompute. The
|
|
# signature travels on with the mail and is of no use to whoever sees it: it
|
|
# fits that one queue id.
|
|
#
|
|
# rspamd 4.2.2 (as 3.11.1), src/plugins/lua/milter_headers.lua: a custom routine is called
|
|
# as function(task, common_meta) and returns error, headers to add, headers to
|
|
# remove, metadata; a remove value of 0 removes every header of that name
|
|
# (docs.rspamd.com/modules/milter_headers, "Custom routines").
|
|
# src/lua/lua_cryptobox.c, rspamd_lua_hash_create(): "sha256" with a key is
|
|
# HMAC-SHA256 over EVP_sha256(), the key being the bytes given - here the hex
|
|
# text. task:get_queue_id() is the Queue-Id the proxy took from the milter
|
|
# macro "{i}" or "i" (src/libserver/milter.c, rspamd_milter_macro_http(); read
|
|
# back in src/libserver/protocol.c), which Postfix sends at
|
|
# end-of-message (Postfix 3.10.13, src/global/mail_params.h:3555,
|
|
# DEF_MILT_EOD_MACROS "i").
|
|
use = ["x-spamd-result", "x-rspamd-action", "selfpost-signature"];
|
|
skip_local = false;
|
|
skip_authenticated = false;
|
|
|
|
custom {
|
|
selfpost-signature = <<EOD
|
|
return function(task, common_meta)
|
|
local remove = { ['X-SelfPost-Filter'] = 0 }
|
|
-- The key is read for every message and kept nowhere: SelfPost may make a
|
|
-- new one (the file was lost, a backup was restored), and a key remembered
|
|
-- here would go on signing what SelfPost no longer accepts until someone
|
|
-- restarted this container. The file is one short line.
|
|
local key
|
|
local f = io.open('/etc/rspamd/selfpost/filter.key', 'r')
|
|
if f then
|
|
key = f:read('*l')
|
|
f:close()
|
|
end
|
|
local qid = task:get_queue_id()
|
|
if not key or key == '' or not qid or qid == '' then
|
|
return nil, {}, remove, {}
|
|
end
|
|
local hash = require "rspamd_cryptobox_hash"
|
|
local sig = hash.create_specific_keyed(key, 'sha256', qid):hex()
|
|
return nil, { ['X-SelfPost-Filter'] = sig }, remove, {}
|
|
end
|
|
EOD;
|
|
}
|