mixandClaude Opus 5.5
668e299c69
Security audit 2026-10-17, findings W6/M9 (low), stage 4. Every application, upstream, recipient or report-address save reloaded Postfix through supervisord, and POST .../dns-recheck bypassed the five-minute cache for up to ~14 resolver queries - both at whatever rate an authenticated user pressed. - writeChanged: each generated map is written only when its content differs from the file on disk, and Postfix is reloaded only when one was (sender map, inbound maps, DMARC maps). Health's Reload configuration ends with an explicit reload (app.Service.ReloadPostfix, SenderMaps gains Reload), so it still re-reads whatever is on disk. No debounce: with unchanged saves gone, a burst is real changes Postfix must see. - auth.AllowDNSRecheck: twenty forced re-checks in 15 minutes per user; past that the outbound, inbound and settings re-check show the cached result without the "re-checked" flash, and the log says why. Tests: TestARebuildThatChangesNothingDoesNotReload, TestDNSRechecksArePerUser; the fakes gain Reload. Docs: guide § Overview and Health; CHANGELOG; plan. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
41 lines
1.2 KiB
Go
41 lines
1.2 KiB
Go
package postfix
|
|
|
|
import (
|
|
"bytes"
|
|
"os"
|
|
|
|
"github.com/mixeme/selfpost/internal/atomicfile"
|
|
)
|
|
|
|
// writeFileAtomic writes data to path via a temp file in the same directory
|
|
// followed by a rename, so a concurrent Postfix reload only ever sees the
|
|
// complete old or new map, never a partial write (security.md).
|
|
func writeFileAtomic(path string, data []byte, perm os.FileMode) error {
|
|
return atomicfile.Write(path, data, perm)
|
|
}
|
|
|
|
// mapFile is one generated table and what it should hold.
|
|
type mapFile struct {
|
|
path string
|
|
data []byte
|
|
}
|
|
|
|
// writeChanged writes each file whose content differs from what is on disk
|
|
// and says whether any did. A save that changes nothing Postfix reads - a
|
|
// domain user saving a form as it was, or changing a field no map holds -
|
|
// then writes nothing and asks no reload: every save used to reload Postfix,
|
|
// at whatever rate a user cared to press (security audit 2026-10-17, W6).
|
|
func writeChanged(files ...mapFile) (bool, error) {
|
|
changed := false
|
|
for _, f := range files {
|
|
if old, err := os.ReadFile(f.path); err == nil && bytes.Equal(old, f.data) {
|
|
continue
|
|
}
|
|
if err := writeFileAtomic(f.path, f.data, 0o640); err != nil {
|
|
return changed, err
|
|
}
|
|
changed = true
|
|
}
|
|
return changed, nil
|
|
}
|