cqrenet/relay
4
0
Fork 0
mirror of https://github.com/chatmail/relay.git synced 2026-05-19 20:38:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Strip DKIM-Signature header before LMTP

Browse Source 
Currently we strip the DKIM-Signature header in the OpenDKIM final.lua
script after validation of the signature. We sign all messages upon
submission, but we do not verify messages which are from a local account
and delivered to another local account.

This corrects the problem and ensures that the plaintext headers of a
local to local delivery are sanitized the same as a message received
from another server.

The functionality in final.lua to strip the DKIM-Signature header can
now be retired.
This commit is contained in:
Mark Felder
2026-01-13 13:26:08 -08:00
committed by missytake
parent a1667ca54d
commit 203a7da3f4
3 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
cmdeploy/src/cmdeploy/postfix/deployer.py
View File

@@ -52,6 +52,15 @@ class PostfixDeployer(Deployer):
) )
need_restart |= header_cleanup.changed need_restart |= header_cleanup.changed
lmtp_header_cleanup = files.put(
src=get_resource("postfix/lmtp_header_cleanup"),
dest="/etc/postfix/lmtp_header_cleanup",
user="root",
group="root",
mode="644",
)
need_restart |= lmtp_header_cleanup.changed
# Login map that 1:1 maps email address to login. # Login map that 1:1 maps email address to login.
login_map = files.put( login_map = files.put(
src=get_resource("postfix/login_map"), src=get_resource("postfix/login_map"),

1
cmdeploy/src/cmdeploy/postfix/lmtp_header_cleanup Normal file
View File

@@ -0,0 +1 @@
/^DKIM-Signature:/ IGNORE

1
cmdeploy/src/cmdeploy/postfix/main.cf.j2
View File

@@ -77,6 +77,7 @@ inet_protocols = all
virtual_transport = lmtp:unix:private/dovecot-lmtp virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_mailbox_domains = {{ config.mail_domain }} virtual_mailbox_domains = {{ config.mail_domain }}
lmtp_header_checks = regexp:/etc/postfix/lmtp_header_cleanup
mua_client_restrictions = permit_sasl_authenticated, reject mua_client_restrictions = permit_sasl_authenticated, reject
mua_sender_restrictions = reject_sender_login_mismatch, permit_sasl_authenticated, reject mua_sender_restrictions = reject_sender_login_mismatch, permit_sasl_authenticated, reject