mixandClaude Opus 5.5
14de9a05c8
internal/milter/sign.go: a milter on two sockets (cmd/panel/signer.go): sign.sock for 465/587, the key of the domain the SASL login belongs to (Bindings.DomainOf, the sender_login_maps Postfix reads), and sign-local.sock for the panel's own sendmail(1) mail, the server's name. go-msgauth/dkim v0.7.0, relaxed/simple, OpenDKIM's dkim_should_signhdrs[] (libopendkim/dkim.c:223-246) in message order plus From once more; keys and selectors from the KeyTable the panel writes, a key path outside the key directory refused; strict - whatever cannot be signed is deferred. From the sources: Postfix 3.10.13 milter8.c:2329-2400 hands a folded header \n-separated, so the signer joins its lines with CRLF; inserts are 1-based in cleanup_ins_header() (cleanup_milter.c:1193), so index 0 is the top, where OpenDKIM puts its own (opendkim.c:3673). go-milter v0.4.1 calls no Abort when a connection ends, so a watchdog closes go-msgauth's streaming signer after an hour and a late end of message is deferred. Postfix: smtpd_milters = sender check, signer, OpenDKIM, journal; non_smtpd_milters = the signer's local socket, OpenDKIM - both sign every message until stage 2. disable_mime_output_conversion=yes (default off, mail_params.h:3088): an 8-bit message is no longer re-encoded after it is signed. Tests: unit tests sign and verify folded, tab-led and space-free headers, an added From:, a changed body, two messages on a connection, odd bodies, and five cases deferred. e2e: the sink image has python3-dkim (dkimpy 1.1.8-2) and the stand's DNS; on an application's message and on a notification the two signatures must agree on h=, bh=, c=, s=, a= and each must pass dkimverify. On the server: make e2e exit 0 (714 s), go vet + go test 27 packages ok. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
114 lines
4.9 KiB
Bash
114 lines
4.9 KiB
Bash
#!/bin/sh
|
|
# Postfix start wrapper: solves the cold-start race where Postfix would try to
|
|
# reach the milter sockets before they are listening.
|
|
#
|
|
# It blocks until the milter sockets — OpenDKIM, the panel's sender check,
|
|
# DKIM signer (two) and journal-milter and, with the inbound relay on, its
|
|
# inbound journal milter —
|
|
# are present, then runs `postfix start-fg` and stays its parent. If they are
|
|
# not ready within the timeout it exits non-zero WITHOUT starting Postfix.
|
|
# supervisord counts that exit as one that came too quickly - the program's
|
|
# startsecs is the timeout plus ten seconds (build/entrypoint.sh) - so after
|
|
# startretries it is FATAL and crashexit takes the container down, instead of
|
|
# a relay running blind (supervisor 4.2.5, supervisor/process.py,
|
|
# Subprocess.finish(): an exit before startsecs is "Exited too quickly" and
|
|
# goes to BACKOFF; transition(): BACKOFF past startretries is FATAL;
|
|
# assumptions C-V6).
|
|
#
|
|
# This handles cold start only. Once Postfix runs, a milter that does not
|
|
# answer costs what its default_action says (build/postfix-config.sh): mail is
|
|
# deferred for OpenDKIM and the sender check, and passes the journal-milter.
|
|
set -eu
|
|
|
|
OPENDKIM_SOCK="${OPENDKIM_SOCKET:-/run/opendkim/opendkim.sock}"
|
|
JOURNAL_SOCK="${JOURNAL_MILTER_SOCKET:-/run/selfpost/journal.sock}"
|
|
SENDER_SOCK="${SENDER_CHECK_SOCKET:-/run/selfpost/sender.sock}"
|
|
SIGN_SOCK="${DKIM_SIGN_SOCKET:-/run/selfpost/sign.sock}"
|
|
SIGN_LOCAL_SOCK="${DKIM_SIGN_LOCAL_SOCKET:-/run/selfpost/sign-local.sock}"
|
|
TIMEOUT="${MILTER_WAIT_TIMEOUT:-30}"
|
|
INTERVAL=1
|
|
|
|
SOCKS="$OPENDKIM_SOCK $JOURNAL_SOCK $SENDER_SOCK $SIGN_SOCK $SIGN_LOCAL_SOCK"
|
|
if [ "${INBOUND_RELAY_ENABLE:-false}" = "true" ]; then
|
|
SOCKS="$SOCKS ${INBOUND_JOURNAL_MILTER_SOCKET:-/run/selfpost/inbound-journal.sock}"
|
|
fi
|
|
|
|
elapsed=0
|
|
for sock in $SOCKS; do
|
|
while [ ! -S "$sock" ]; do
|
|
if [ "$elapsed" -ge "$TIMEOUT" ]; then
|
|
echo "postfix-wrapper: timed out after ${TIMEOUT}s waiting for milter socket $sock" >&2
|
|
exit 1
|
|
fi
|
|
sleep "$INTERVAL"
|
|
elapsed=$((elapsed + INTERVAL))
|
|
done
|
|
echo "postfix-wrapper: milter socket ready: $sock"
|
|
done
|
|
|
|
echo "postfix-wrapper: milter sockets ready, starting postfix"
|
|
# Postfix 3.10.13: postfix(1) execs conf/postfix-script (src/postfix/postfix.c:669),
|
|
# whose "start-fg" (:200-210) execs master only as PID 1 and otherwise runs
|
|
# "master -s" as its child; master then makes itself a session leader
|
|
# (src/master/master.c:441, setsid()). A signal supervisord sends this
|
|
# program never reaches master
|
|
# (supervisor 4.2.5, supervisor/process.py, Subprocess.kill(): to the pid
|
|
# alone without stopasgroup, and master is not in its group anyway): before,
|
|
# a stop left master running - a restart of the program then found Postfix
|
|
# "already running", and a stop of the container cut Postfix off with
|
|
# SIGKILL (assumptions C-P42). So this shell stays, and on TERM or INT runs
|
|
# "postfix stop" (conf/postfix-script:237-253, "stop": TERM to master, then
|
|
# waits up to five seconds and kills its group; src/master/master_sig.c:205,
|
|
# master_sigdeath(): "terminating on signal 15"). Debian's redirect of
|
|
# "postfix start" to systemd (debian/patches/
|
|
# debian-re-run-startup-through-systemd.patch, conf/postfix-script:170-189)
|
|
# leaves start-fg alone and needs /run/systemd/system, which this container
|
|
# has not.
|
|
#
|
|
# Since Postfix 3.8 postfix(1) and postlog(1) - postfix-script's $INFO, $WARN
|
|
# and $FATAL - write their messages to stderr even when it is not a terminal
|
|
# (src/postfix/postfix.c:546, msg_vstream_init() no longer under isatty();
|
|
# RELEASE_NOTES-3.8:114-115, [Incompat 20230308]), besides maillog_file. So
|
|
# "starting the Postfix mail system", "stopping ..." and check-warn's
|
|
# warnings now reach the container's log through this program's stderr
|
|
# (build/supervisord.conf) as well as /data/log/mail.log; nothing reads them
|
|
# there but a person.
|
|
#
|
|
# "postfix start-fg" spends its first seconds in its checks before master
|
|
# runs; a stop asked then would find nothing to stop, so it is asked again
|
|
# until the child is gone. "master -t" exits 0, silently, while no master
|
|
# holds the lock (src/master/master.c:495-499, test_lock).
|
|
daemon_directory=$(postconf -h daemon_directory)
|
|
child=
|
|
stop_asked=
|
|
stop_postfix() {
|
|
if [ -z "$child" ]; then
|
|
# Between "&" and "child=$!": stopped right after the pid is known.
|
|
stop_asked=1
|
|
return
|
|
fi
|
|
trap '' TERM INT
|
|
while kill -0 "$child" 2>/dev/null; do
|
|
if "$daemon_directory/master" -t 2>/dev/null; then
|
|
sleep 1
|
|
else
|
|
postfix stop || true
|
|
fi
|
|
done
|
|
exit 0
|
|
}
|
|
trap stop_postfix TERM INT
|
|
postfix start-fg &
|
|
child=$!
|
|
if [ -n "$stop_asked" ]; then
|
|
stop_postfix
|
|
fi
|
|
# A trapped signal makes wait return at once, the trap is taken right after
|
|
# (POSIX, Shell Command Language, 2.11 Signals and Error Handling) and exits.
|
|
# Otherwise wait returns when Postfix ended on its own: its status is this
|
|
# program's, and supervisord restarts it.
|
|
status=0
|
|
wait "$child" || status=$?
|
|
echo "postfix-wrapper: postfix exited with status $status" >&2
|
|
exit "$status"
|