mixandClaude Opus 5.5
1c6e04b7d3
test / test (push) Canceled after 0s
The runtime base is debian:trixie-slim, the build stage golang:1.26-trixie:
Postfix 3.10.13 with upstream's 2026 security fixes up to the August
batch, libmilter 8.18.1, OpenSSL 3.5. Every citation of another program in
code, scripts and documents was re-read against the trixie sources
(dev/upstream; bookworm's kept in dev/upstream-bookworm) and updated;
development.md's cited-package table holds the trixie versions.
What the re-reading changed in behaviour:
- logtail: reject lines with sasl_method/sasl_username/sasl_sender
(smtpd_check.c:1019-1026); cleanup's "removed (canceled)" forgets a
port-25 id (cleanup_api.c:363-364).
- internal/postfix/retry.go reads postconf's stdout only: since 3.9 a
deprecated-parameter warning on stderr made one value too many and the
panel fell back to the compiled-in retry policy.
- logrotate-loop.sh: logrotate 3.22 exits 1 when it ignores a config;
the loop refuses on that output whatever the status.
- postfix-config.sh: cyrus_sasl_config_path set explicitly (bookworm's
07_sasl_config.diff is gone); maillog_file_permissions=0640; mynetworks
explicit; Dockerfile: SYNC_CHROOT= in /etc/default/postfix,
opendkim-tools dropped, openssl named, systemd-standalone-sysusers so
cron does not bring the whole of systemd.
- The selfpost group is 10998, outside the system range 100-999: in
trixie a package took 998 and the build failed (owner's decision:
a conflict-free id, the distribution's own ids untouched). The
entrypoint hands /data back by name when the user or the group differs.
Guide, backup refusal text, help (design commit 68ec8b2), e2e.
- smtpd_hide_client_session=yes on smtps and submission (owner's
decision): Received: names no client, TLS, login or protocol; port 25
keeps the full header. e2e checks both.
- test/upstream/opendkim-probe.sh makes keys with openssl genrsa.
Tests: on the server, make e2e exit 0 (674 s, the image built on trixie),
go vet + go test 27 packages ok. CHANGELOG [Unreleased], guide,
architecture.md, security.md, roadmap.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
76 lines
2.3 KiB
Go
76 lines
2.3 KiB
Go
package postfix
|
|
|
|
import (
|
|
"fmt"
|
|
"path/filepath"
|
|
"sort"
|
|
"strings"
|
|
)
|
|
|
|
// DMARCMapsConfig is the allow-list material for DMARC aggregate ingest.
|
|
type DMARCMapsConfig struct {
|
|
Recipients []string
|
|
Domains []string
|
|
}
|
|
|
|
func (p *Postfix) dmarcMapPaths() (recipients, transport, relayDomains string) {
|
|
dir := filepath.Dir(p.senderLoginMapsPath)
|
|
return filepath.Join(dir, "dmarc_recipients"),
|
|
filepath.Join(dir, "dmarc_transport"),
|
|
filepath.Join(dir, "dmarc_relay_domains")
|
|
}
|
|
|
|
// RebuildDMARCMaps regenerates DMARC ingest lookup tables. Empty config clears
|
|
// the files so port-25 ingest is off even if the listener stays up for inbound
|
|
// relay.
|
|
func (p *Postfix) RebuildDMARCMaps(cfg DMARCMapsConfig) error {
|
|
recip, transport, relay, err := renderDMARCMaps(cfg)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
rc, tr, rd := p.dmarcMapPaths()
|
|
if err := writeFileAtomic(rc, recip, 0o640); err != nil {
|
|
return err
|
|
}
|
|
if err := writeFileAtomic(tr, transport, 0o640); err != nil {
|
|
return err
|
|
}
|
|
if err := writeFileAtomic(rd, relay, 0o640); err != nil {
|
|
return err
|
|
}
|
|
return p.reload()
|
|
}
|
|
|
|
// Postfix 3.10.13, man/man5/access.5: "OK" accepts the address the key
|
|
// matches; man/man5/transport.5: "user@domain transport:nexthop", and "a
|
|
// non-null transport field with a null nexthop field resets the nexthop
|
|
// information to the recipient domain"; relay_domains as in renderInboundMaps.
|
|
func renderDMARCMaps(cfg DMARCMapsConfig) (recipients, transport, relayDomains []byte, err error) {
|
|
recipients = []byte{}
|
|
transport = []byte{}
|
|
relayDomains = []byte{}
|
|
if len(cfg.Recipients) == 0 {
|
|
return recipients, transport, relayDomains, nil
|
|
}
|
|
addrs := append([]string(nil), cfg.Recipients...)
|
|
sort.Strings(addrs)
|
|
var recipB, transportB strings.Builder
|
|
for _, addr := range addrs {
|
|
if err := assertMapToken(addr, "recipient"); err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
fmt.Fprintf(&recipB, "%s OK\n", addr)
|
|
fmt.Fprintf(&transportB, "%s dmarc-ingest:\n", addr)
|
|
}
|
|
domains := append([]string(nil), cfg.Domains...)
|
|
sort.Strings(domains)
|
|
var relayB strings.Builder
|
|
for _, d := range domains {
|
|
if err := assertMapToken(d, "domain"); err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
fmt.Fprintf(&relayB, "%s OK\n", d)
|
|
}
|
|
return []byte(recipB.String()), []byte(transportB.String()), []byte(relayB.String()), nil
|
|
}
|