mixandClaude Opus 5.5
d398f488e2
test / test (push) Canceled after 0s
Closes what the security review left as an accepted risk: with the
spam filter down - it is attached fail-open - nothing removes verdict
headers a sender wrote himself, and the inbound journal recorded his
verdict as the filter's. The owner asked whether rspamd could add a
header that proves the others are ours (2026-10-12) and agreed to a
signature: a fixed mark could be written by a sender as easily as the
verdict.
- inbound.FilterKey: a key of 32 random bytes, 64 hex characters, in
/data/antispam/filter.key, made on the first start with the relay
on. 0644 like the list files beside it: the filter is another user
in another container.
- deploy/antispam/rspamd/milter_headers.conf: a custom routine reads
the key through the directory the sidecar already mounts and adds
X-SelfPost-Filter, the HMAC-SHA256 of the message's queue id, hex;
a header of that name from the sender is removed.
- internal/milter/inbound.go: the verdict headers are kept as they
are read, and at end-of-message - when the queue id is known - they
count only if the signature fits (FilterSignature, hmac.Equal). No
key, no queue id, no signature or a wrong one: the row is that of
mail nobody judged (accept, selfpost, no detail).
The signature goes on to the upstream with the mail and is of no use
there: it fits one queue id.
Tried in a throwaway rspamd 3.11 container on the test server before
the Go side was written: the routine loads, signs
(2aa1ca6d... for key 0123...cdef and queue id 4A1B2C3D5E, the value
python's hmac gives and TestFilterSignatureIsWhatTheFilterWrites
pins), removes a sender's header of the same name, and adds nothing
without a queue id.
Tests: signed, unsigned, made-up, another message's, another key's,
the sender's followed by the real one, the next message on the
connection, no queue id; the key made once, read after, replaced when
damaged, left alone by the lists. e2e: filter.key is there, 644, 65
bytes.
docs/security.md: the accepted risk is replaced by a narrower one (the
key is readable on the host); Mail path describes the signature.
Checked on the test server, uncommitted tree: go vet ./... ok,
go test ./... ok (22 packages), make e2e ok.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
44 lines
1.7 KiB
Plaintext
44 lines
1.7 KiB
Plaintext
# Mounted into the sidecar as /etc/rspamd/local.d/milter_headers.conf.
|
|
#
|
|
# rspamd writes its verdict into two headers of every message it lets through:
|
|
# the action it chose and the score with the symbols behind it. SelfPost's
|
|
# inbound journal reads them (Inbound > Log shows them next to the message),
|
|
# and the upstream mailbox server receives them with the mail.
|
|
#
|
|
# rspamd removes headers of these names that a sender wrote himself before it
|
|
# adds its own. Without this file the journal still lists accepted mail, with
|
|
# no verdict next to it.
|
|
#
|
|
# The third header is the proof that the other two are rspamd's. The filter is
|
|
# attached so that mail still flows when it is down, and then nothing removes
|
|
# what a sender wrote: he could send his own verdict. So rspamd signs each
|
|
# message - an HMAC-SHA256 of the message's queue id under a key SelfPost
|
|
# generates and leaves in the directory it shares with this container - and
|
|
# SelfPost reads a verdict only next to a signature it can recompute. The
|
|
# signature travels on with the mail and is of no use to whoever sees it: it
|
|
# fits that one queue id.
|
|
use = ["x-spamd-result", "x-rspamd-action", "selfpost-signature"];
|
|
|
|
custom {
|
|
selfpost-signature = <<EOD
|
|
local key
|
|
return function(task, common_meta)
|
|
local remove = { ['X-SelfPost-Filter'] = 0 }
|
|
if not key then
|
|
local f = io.open('/etc/rspamd/selfpost/filter.key', 'r')
|
|
if f then
|
|
key = f:read('*l')
|
|
f:close()
|
|
end
|
|
end
|
|
local qid = task:get_queue_id()
|
|
if not key or key == '' or not qid or qid == '' then
|
|
return nil, {}, remove, {}
|
|
end
|
|
local hash = require "rspamd_cryptobox_hash"
|
|
local sig = hash.create_specific_keyed(key, 'sha256', qid):hex()
|
|
return nil, { ['X-SelfPost-Filter'] = sig }, remove, {}
|
|
end
|
|
EOD;
|
|
}
|