From 0d61c13c580cb45c8d288f7f9ba612d8f0920e7a Mon Sep 17 00:00:00 2001 From: link2xt Date: Sat, 18 May 2024 02:21:43 +0000 Subject: [PATCH] DKIM-sign Content-Type and oversign all signed headers Oversigning (including header name in DKIM-Signature more times that it appears in the mail) prevents adding more headers with the same name without invalidating DKIM signature. We don't want middleboxes to insert a second From header, adding Cc field to mails that don't have one etc. --- CHANGELOG.md | 3 +++ cmdeploy/src/cmdeploy/opendkim/opendkim.conf | 19 ++++++++++++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b9bd5ef7..a2a9fb58 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -33,6 +33,9 @@ - dovecot: enable gzip compression on disk ([#341](https://github.com/deltachat/chatmail/pull/341)) +- DKIM-sign Content-Type and oversign all signed headers + ([#296](https://github.com/deltachat/chatmail/pull/296)) + ## 1.3.0 - 2024-06-06 - don't check necessary DNS records on cmdeploy init anymore diff --git a/cmdeploy/src/cmdeploy/opendkim/opendkim.conf b/cmdeploy/src/cmdeploy/opendkim/opendkim.conf index fb914064..2cc930e9 100644 --- a/cmdeploy/src/cmdeploy/opendkim/opendkim.conf +++ b/cmdeploy/src/cmdeploy/opendkim/opendkim.conf @@ -25,7 +25,24 @@ KeyTable /etc/dkimkeys/KeyTable SigningTable refile:/etc/dkimkeys/SigningTable # Sign Autocrypt header in addition to the default specified in RFC 6376. -SignHeaders *,+autocrypt +# +# Default list is here: +# +SignHeaders *,+autocrypt,+content-type + +# Prevent addition of second Content-Type header +# and other important headers that should not be added +# after signing the message. +# See +# +# and RFC 6376 (page 41) for reference. +# +# We don't use "l=" body length so the problem described in RFC 6376 +# is not applicable, but adding e.g. a second "From" header +# or second "Autocrypt" header is better prevented in any case. +# +# Default is empty. +OversignHeaders from,reply-to,subject,date,to,cc,resent-date,resent-from,resent-sender,resent-to,resent-cc,in-reply-to,references,list-id,list-help,list-unsubscribe,list-subscribe,list-post,list-owner,list-archive,autocrypt # Script to ignore signatures that do not correspond to the From: domain. ScreenPolicyScript /etc/opendkim/screen.lua