mixandClaude Opus 5.5
f1d90a2a1b
test / test (push) Waiting to run
The security documentation's last open item of panel-dkim-signing (the owner's decision, 2026-10-16): go-milter v0.4.1 added every header of a session to a map of its own, emptied only on ABORT, and handed it to Headers - which no milter of the panel reads. Postfix bounds one header, not their number, so a message of nothing but headers up to the message size limit was held whole by the library in the sender check, the signer and the journal milter on 465/587 and in the inbound journal milter on port 25, where strangers send; the signer's 1 MiB refusal came after it was all in. third_party/go-milter is v0.4.1 from the module cache (BSD 2-Clause, LICENSE kept) with session.go changed: CodeHeader hands the header to Header and keeps nothing, CodeEOH hands Headers an empty map. PATCHES.md says what and why, and how to take a new upstream version. go.mod replaces the module with it; the Dockerfile copies third_party before "go mod download". TestTheLibraryKeepsNoHeaders holds it through the library's own client over two messages of one connection. Comments, security.md (the accepted risk becomes a note), development.md's library table, the plan and CHANGELOG follow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
88 lines
2.3 KiB
Go
88 lines
2.3 KiB
Go
package milter
|
|
|
|
import (
|
|
"context"
|
|
"net"
|
|
"net/textproto"
|
|
"sync"
|
|
"testing"
|
|
|
|
"github.com/emersion/go-milter"
|
|
)
|
|
|
|
// headerRecorder is a backend that notes what the library hands it.
|
|
type headerRecorder struct {
|
|
milter.NoOpMilter
|
|
mu *sync.Mutex
|
|
headers *[]string
|
|
mapSizes *[]int
|
|
}
|
|
|
|
func (r headerRecorder) Header(name, value string, m *milter.Modifier) (milter.Response, error) {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
*r.headers = append(*r.headers, name)
|
|
return milter.RespContinue, nil
|
|
}
|
|
|
|
func (r headerRecorder) Headers(h textproto.MIMEHeader, m *milter.Modifier) (milter.Response, error) {
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
*r.mapSizes = append(*r.mapSizes, len(h))
|
|
return milter.RespContinue, nil
|
|
}
|
|
|
|
// The go-milter the panel builds (third_party/go-milter/PATCHES.md) hands
|
|
// every header to Header and keeps none: the map Headers gets is empty, on
|
|
// the first message of a connection and on the next - upstream kept every
|
|
// header of the connection until an ABORT.
|
|
func TestTheLibraryKeepsNoHeaders(t *testing.T) {
|
|
var mu sync.Mutex
|
|
var headers []string
|
|
var mapSizes []int
|
|
ln, err := net.Listen("tcp", "127.0.0.1:0")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
srv := &milter.Server{
|
|
NewMilter: func() milter.Milter { return headerRecorder{mu: &mu, headers: &headers, mapSizes: &mapSizes} },
|
|
Protocol: milter.OptNoBody,
|
|
}
|
|
ctx, cancel := context.WithCancel(context.Background())
|
|
defer cancel()
|
|
go func() { <-ctx.Done(); _ = srv.Close() }()
|
|
go func() { _ = srv.Serve(ln) }()
|
|
|
|
cl := milter.NewClientWithOptions("tcp", ln.Addr().String(), milter.ClientOptions{})
|
|
defer cl.Close()
|
|
s, err := cl.Session()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer s.Close()
|
|
for i := 0; i < 2; i++ {
|
|
if _, err := s.Mail("<a@example.org>", nil); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := s.Rcpt("<b@example.net>", nil); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, name := range []string{"From", "To", "X-Filler"} {
|
|
if _, err := s.HeaderField(name, " value"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
if _, err := s.HeaderEnd(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
mu.Lock()
|
|
defer mu.Unlock()
|
|
if len(headers) != 6 {
|
|
t.Errorf("Header saw %v, want the three headers of each of two messages", headers)
|
|
}
|
|
if len(mapSizes) != 2 || mapSizes[0] != 0 || mapSizes[1] != 0 {
|
|
t.Errorf("Headers got maps of %v headers, want two empty ones", mapSizes)
|
|
}
|
|
}
|