mixandClaude Opus 5.5
d398f488e2
test / test (push) Canceled after 0s
Closes what the security review left as an accepted risk: with the
spam filter down - it is attached fail-open - nothing removes verdict
headers a sender wrote himself, and the inbound journal recorded his
verdict as the filter's. The owner asked whether rspamd could add a
header that proves the others are ours (2026-10-12) and agreed to a
signature: a fixed mark could be written by a sender as easily as the
verdict.
- inbound.FilterKey: a key of 32 random bytes, 64 hex characters, in
/data/antispam/filter.key, made on the first start with the relay
on. 0644 like the list files beside it: the filter is another user
in another container.
- deploy/antispam/rspamd/milter_headers.conf: a custom routine reads
the key through the directory the sidecar already mounts and adds
X-SelfPost-Filter, the HMAC-SHA256 of the message's queue id, hex;
a header of that name from the sender is removed.
- internal/milter/inbound.go: the verdict headers are kept as they
are read, and at end-of-message - when the queue id is known - they
count only if the signature fits (FilterSignature, hmac.Equal). No
key, no queue id, no signature or a wrong one: the row is that of
mail nobody judged (accept, selfpost, no detail).
The signature goes on to the upstream with the mail and is of no use
there: it fits one queue id.
Tried in a throwaway rspamd 3.11 container on the test server before
the Go side was written: the routine loads, signs
(2aa1ca6d... for key 0123...cdef and queue id 4A1B2C3D5E, the value
python's hmac gives and TestFilterSignatureIsWhatTheFilterWrites
pins), removes a sender's header of the same name, and adds nothing
without a queue id.
Tests: signed, unsigned, made-up, another message's, another key's,
the sender's followed by the real one, the next message on the
connection, no queue id; the key made once, read after, replaced when
damaged, left alone by the lists. e2e: filter.key is there, 644, 65
bytes.
docs/security.md: the accepted risk is replaced by a narrower one (the
key is readable on the host); Mail path describes the signature.
Checked on the test server, uncommitted tree: go vet ./... ok,
go test ./... ok (22 packages), make e2e ok.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
76 lines
2.7 KiB
Go
76 lines
2.7 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"log"
|
|
"net"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
"github.com/mixeme/selfpost/internal/inbound"
|
|
"github.com/mixeme/selfpost/internal/milter"
|
|
"github.com/mixeme/selfpost/internal/store"
|
|
)
|
|
|
|
// serveJournal opens the journal-milter Unix socket and runs the real milter
|
|
// (architecture.md § Mail path), recording accepted messages into the send
|
|
// log. Socket lifecycle (creation, stale cleanup, group permissions) lives
|
|
// in listenMilter; the protocol handler lives in internal/milter.
|
|
func serveJournal(ctx context.Context, cfg config, st *store.Store) error {
|
|
ln, err := listenMilter(cfg.journalSocket)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
log.Printf("journal-milter listening on %s", cfg.journalSocket)
|
|
return milter.Serve(ctx, ln, st)
|
|
}
|
|
|
|
// serveInboundJournal runs the inbound journal milter, the last milter on
|
|
// port 25 (internal/milter/inbound.go). It exists only while the inbound relay
|
|
// is on: build/postfix-config.sh attaches the socket under the same condition.
|
|
func serveInboundJournal(ctx context.Context, cfg config, st *store.Store) error {
|
|
ln, err := listenMilter(cfg.inboundJournalSocket)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
// With a filter attached, the key it signs with. Without the key no
|
|
// verdict can be told from a sender's own, so none is read: the journal
|
|
// still records the mail, and the log says why it shows no verdicts.
|
|
key := ""
|
|
if cfg.inboundAntispamMilter != "" {
|
|
if key, err = inbound.FilterKey(cfg.antispamDir); err != nil {
|
|
log.Printf("inbound-journal-milter: no key for the filter's signature, verdicts will not be recorded: %v", err)
|
|
key = ""
|
|
}
|
|
}
|
|
log.Printf("inbound-journal-milter listening on %s", cfg.inboundJournalSocket)
|
|
return milter.ServeInbound(ctx, ln, st, key)
|
|
}
|
|
|
|
// listenMilter opens a milter's Unix socket where Postfix can reach it.
|
|
func listenMilter(socketPath string) (net.Listener, error) {
|
|
if err := os.MkdirAll(filepath.Dir(socketPath), 0o755); err != nil {
|
|
return nil, err
|
|
}
|
|
// Clear a stale socket left behind by an unclean shutdown, otherwise the
|
|
// listen below fails with "address already in use".
|
|
if err := os.Remove(socketPath); err != nil && !errors.Is(err, os.ErrNotExist) {
|
|
return nil, err
|
|
}
|
|
|
|
ln, err := net.Listen("unix", socketPath)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
// Postfix (user `postfix`) connects to this socket as a milter and needs
|
|
// group access. The socket inherits group `selfpost` from the setgid parent
|
|
// dir entrypoint.sh prepares; make it group read/write so postfix can reach
|
|
// it (connecting to a Unix socket needs write permission on the node).
|
|
if err := os.Chmod(socketPath, 0o660); err != nil {
|
|
ln.Close()
|
|
return nil, err
|
|
}
|
|
return ln, nil
|
|
}
|