mixandClaude Opus 5.5
f1d90a2a1b
test / test (push) Waiting to run
The security documentation's last open item of panel-dkim-signing (the owner's decision, 2026-10-16): go-milter v0.4.1 added every header of a session to a map of its own, emptied only on ABORT, and handed it to Headers - which no milter of the panel reads. Postfix bounds one header, not their number, so a message of nothing but headers up to the message size limit was held whole by the library in the sender check, the signer and the journal milter on 465/587 and in the inbound journal milter on port 25, where strangers send; the signer's 1 MiB refusal came after it was all in. third_party/go-milter is v0.4.1 from the module cache (BSD 2-Clause, LICENSE kept) with session.go changed: CodeHeader hands the header to Header and keeps nothing, CodeEOH hands Headers an empty map. PATCHES.md says what and why, and how to take a new upstream version. go.mod replaces the module with it; the Dockerfile copies third_party before "go mod download". TestTheLibraryKeepsNoHeaders holds it through the library's own client over two messages of one connection. Comments, security.md (the accepted risk becomes a note), development.md's library table, the plan and CHANGELOG follow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
58 lines
2.2 KiB
Go
58 lines
2.2 KiB
Go
// Package milter provides an interface to implement milter mail filters
|
|
package milter
|
|
|
|
// OptAction sets which actions the milter wants to perform.
|
|
// Multiple options can be set using a bitmask.
|
|
type OptAction uint32
|
|
|
|
// Set which actions the milter wants to perform.
|
|
const (
|
|
OptAddHeader OptAction = 1 << 0 // SMFIF_ADDHDRS
|
|
OptChangeBody OptAction = 1 << 1 // SMFIF_CHGBODY
|
|
OptAddRcpt OptAction = 1 << 2 // SMFIF_ADDRCPT
|
|
OptRemoveRcpt OptAction = 1 << 3 // SMFIF_DELRCPT
|
|
OptChangeHeader OptAction = 1 << 4 // SMFIF_CHGHDRS
|
|
OptQuarantine OptAction = 1 << 5 // SMFIF_QUARANTINE
|
|
|
|
// [v6]
|
|
OptChangeFrom OptAction = 1 << 6 // SMFIF_CHGFROM
|
|
OptAddRcptWithArgs OptAction = 1 << 7 // SMFIF_ADDRCPT_PAR
|
|
OptSetSymList OptAction = 1 << 8 // SMFIF_SETSYMLIST
|
|
)
|
|
|
|
// OptProtocol masks out unwanted parts of the SMTP transaction.
|
|
// Multiple options can be set using a bitmask.
|
|
type OptProtocol uint32
|
|
|
|
const (
|
|
OptNoConnect OptProtocol = 1 << 0 // SMFIP_NOCONNECT
|
|
OptNoHelo OptProtocol = 1 << 1 // SMFIP_NOHELO
|
|
OptNoMailFrom OptProtocol = 1 << 2 // SMFIP_NOMAIL
|
|
OptNoRcptTo OptProtocol = 1 << 3 // SMFIP_NORCPT
|
|
OptNoBody OptProtocol = 1 << 4 // SMFIP_NOBODY
|
|
OptNoHeaders OptProtocol = 1 << 5 // SMFIP_NOHDRS
|
|
OptNoEOH OptProtocol = 1 << 6 // SMFIP_NOEOH
|
|
OptNoUnknown OptProtocol = 1 << 8 // SMFIP_NOUNKNOWN
|
|
OptNoData OptProtocol = 1 << 9 // SMFIP_NODATA
|
|
|
|
// [v6] MTA supports ActSkip
|
|
OptSkip OptProtocol = 1 << 10 // SMFIP_SKIP
|
|
// [v6] Filter wants rejected RCPTs
|
|
OptRcptRej OptProtocol = 1 << 11 // SMFIP_RCPT_REJ
|
|
|
|
// Milter will not send action response for the following MTA messages
|
|
OptNoHeaderReply OptProtocol = 1 << 7 // SMFIP_NR_HDR, SMFIP_NOHREPL
|
|
// [v6]
|
|
OptNoConnReply OptProtocol = 1 << 12 // SMFIP_NR_CONN
|
|
OptNoHeloReply OptProtocol = 1 << 13 // SMFIP_NR_HELO
|
|
OptNoMailReply OptProtocol = 1 << 14 // SMFIP_NR_MAIL
|
|
OptNoRcptReply OptProtocol = 1 << 15 // SMFIP_NR_RCPT
|
|
OptNoDataReply OptProtocol = 1 << 16 // SMFIP_NR_DATA
|
|
OptNoUnknownReply OptProtocol = 1 << 17 // SMFIP_NR_UNKN
|
|
OptNoEOHReply OptProtocol = 1 << 18 // SMFIP_NR_EOH
|
|
OptNoBodyReply OptProtocol = 1 << 19 // SMFIP_NR_BODY
|
|
|
|
// [v6]
|
|
OptHeaderLeadingSpace OptProtocol = 1 << 20 // SMFIP_HDR_LEADSPC
|
|
)
|