mixandClaude Opus 5.5
b113e72c71
Comments only, no behaviour changed. go-milter v0.4.1 (session.go: one session per connection, replaced after a non-continue reply; macros per stage), Postfix 3.7.11 (milter8.c, smtpd_check.c reject_auth_sender_login_mismatch(), mail_addr_find.c, showq_compat.c, mail_conf_time.c, mail_params.h), Cyrus SASL 2.1.28 (saslpasswd.c, plugins/sasldb.c: deleting a missing login is not an error), OpenDKIM 2.11.0~beta2 (opendkim-db.c, opendkim-genkey), Berkeley DB 5.3 db_dump, rspamd 3.11.0. Comments that claimed what the source denies are corrected (sasldb keeps the password as given, not hashed; an embedded newline is kept, not truncated; rspamd sorts symbols by absolute weight); fixtures say seen or composed. The sender check's From: parsing gets no citations: it is replaced by the port of OpenDKIM's dkim_mail_parse next. Contradictions left for their own commits: B-G5 cleanAddress, B-PS1 first key wins, B-PQ1 the forced-expire flag, B-PQ10/PQ11 Postfix's time units. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
76 lines
2.3 KiB
Go
76 lines
2.3 KiB
Go
package postfix
|
|
|
|
import (
|
|
"fmt"
|
|
"path/filepath"
|
|
"sort"
|
|
"strings"
|
|
)
|
|
|
|
// DMARCMapsConfig is the allow-list material for DMARC aggregate ingest.
|
|
type DMARCMapsConfig struct {
|
|
Recipients []string
|
|
Domains []string
|
|
}
|
|
|
|
func (p *Postfix) dmarcMapPaths() (recipients, transport, relayDomains string) {
|
|
dir := filepath.Dir(p.senderLoginMapsPath)
|
|
return filepath.Join(dir, "dmarc_recipients"),
|
|
filepath.Join(dir, "dmarc_transport"),
|
|
filepath.Join(dir, "dmarc_relay_domains")
|
|
}
|
|
|
|
// RebuildDMARCMaps regenerates DMARC ingest lookup tables. Empty config clears
|
|
// the files so port-25 ingest is off even if the listener stays up for inbound
|
|
// relay.
|
|
func (p *Postfix) RebuildDMARCMaps(cfg DMARCMapsConfig) error {
|
|
recip, transport, relay, err := renderDMARCMaps(cfg)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
rc, tr, rd := p.dmarcMapPaths()
|
|
if err := writeFileAtomic(rc, recip, 0o640); err != nil {
|
|
return err
|
|
}
|
|
if err := writeFileAtomic(tr, transport, 0o640); err != nil {
|
|
return err
|
|
}
|
|
if err := writeFileAtomic(rd, relay, 0o640); err != nil {
|
|
return err
|
|
}
|
|
return p.reload()
|
|
}
|
|
|
|
// Postfix 3.7.11, man/man5/access.5: "OK" accepts the address the key
|
|
// matches; man/man5/transport.5: "user@domain transport:nexthop", and "a
|
|
// non-null transport field with a null nexthop field resets the nexthop
|
|
// information to the recipient domain"; relay_domains as in renderInboundMaps.
|
|
func renderDMARCMaps(cfg DMARCMapsConfig) (recipients, transport, relayDomains []byte, err error) {
|
|
recipients = []byte{}
|
|
transport = []byte{}
|
|
relayDomains = []byte{}
|
|
if len(cfg.Recipients) == 0 {
|
|
return recipients, transport, relayDomains, nil
|
|
}
|
|
addrs := append([]string(nil), cfg.Recipients...)
|
|
sort.Strings(addrs)
|
|
var recipB, transportB strings.Builder
|
|
for _, addr := range addrs {
|
|
if err := assertMapToken(addr, "recipient"); err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
fmt.Fprintf(&recipB, "%s OK\n", addr)
|
|
fmt.Fprintf(&transportB, "%s dmarc-ingest:\n", addr)
|
|
}
|
|
domains := append([]string(nil), cfg.Domains...)
|
|
sort.Strings(domains)
|
|
var relayB strings.Builder
|
|
for _, d := range domains {
|
|
if err := assertMapToken(d, "domain"); err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
fmt.Fprintf(&relayB, "%s OK\n", d)
|
|
}
|
|
return []byte(recipB.String()), []byte(transportB.String()), []byte(relayB.String()), nil
|
|
}
|