fix: only allow ports above 1024 for imap + smtp

Default behavior is processing headers
that are actually part of the message body.
This is unlikely to be needed
as headers such as Received are not added into MIME parts,
but may result in broken DKIM signatures
if the body is modified.

.github/workflows/ci.yaml

@@ -29,7 +29,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
       - name: download filtermail
-        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.1/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
+        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.4/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
       - name: run chatmaild tests 
         working-directory: chatmaild
         run: pipx run tox

chatmaild/src/chatmaild/config.py

@@ -1,5 +1,6 @@
 import ipaddress
 from pathlib import Path
+from random import randint
 
 import iniconfig
 
@@ -41,6 +42,11 @@ class Config:
         self.username_max_length = int(params.pop("username_max_length", 9))
         self.password_min_length = int(params.pop("password_min_length", 9))
         self.www_folder = params.pop("www_folder", "")
+
+        self.imap_port = int(params.pop("imap_port", 143))
+        self.imaps_port = int(params.pop("imaps_port", 993))
+        self.smtp_port = int(params.pop("smtp_port", 587))
+        self.smtps_port = int(params.pop("smtps_port", 465))
         self.filtermail_smtp_port = int(params.pop("filtermail_smtp_port", "10080"))
         self.filtermail_smtp_port_incoming = int(
             params.pop("filtermail_smtp_port_incoming", "10081")
@@ -138,8 +144,15 @@ def parse_size_mb(limit):
 
 def write_initial_config(inipath, mail_domain, overrides):
     """Write out default config file, using the specified config value overrides."""
-    content = get_default_config_content(mail_domain, **overrides)
+    content = get_default_config_content(mail_domain, **overrides).splitlines()
-    inipath.write_text(content)
+    used_ports = [25, 53, 80, 143, 402, 443, 465, 587, 993, 3340, 3903, 3904, 8443, 10080, 10081, 10082, 10083, 10025, 10026]
+    for config_key in ["smtp_port", "imap_port", "smtps_port", "imaps_port"]:
+        value = randint(1024, 65536)
+        while value in used_ports:
+            value = randint(65535)
+        used_ports.append(value)
+        content.append(f"{config_key} = {value}")
+    inipath.write_text("\n".join(content))
 
 
 def get_default_config_content(mail_domain, **overrides):

cmdeploy/src/cmdeploy/acmetool/response-file.yaml.j2

@@ -1,2 +1,2 @@
 "acme-enter-email": "{{ email }}"
-"acme-agreement:https://letsencrypt.org/documents/LE-SA-v1.7-June-04-2026.pdf": true
+"acme-agreement:https://letsencrypt.org/documents/LE-SA-v1.8-July-06-2026.pdf": true

cmdeploy/src/cmdeploy/deployers.py

@@ -496,15 +496,15 @@ def deploy_chatmail(config_path: Path, disable_mail: bool, website_only: bool) -
         if config.tls_cert_mode == "acme":
             port_services.append(("acmetool", 402))
         port_services += [
-            (["imap-login", "dovecot"], 143),
+            (["imap-login", "dovecot", "nginx"], config.imap_port),
             # acmetool previously listened on port 80,
             # so don't complain during upgrade that moved it to port 402
             # and gave the port to nginx.
             (["acmetool", "nginx"], 80),
             ("nginx", 443),
-            (["master", "smtpd"], 465),
+            (["master", "smtpd", "nginx"], config.smtp_port),
-            (["master", "smtpd"], 587),
+            (["master", "smtpd", "nginx"], config.smtps_port),
-            (["imap-login", "dovecot"], 993),
+            (["imap-login", "dovecot", "nginx"], config.imaps_port),
             ("iroh-relay", 3340),
             ("mtail", 3903),
             ("stats", 3904),

cmdeploy/src/cmdeploy/filtermail/deployer.py

@@ -20,10 +20,10 @@ class FiltermailDeployer(Deployer):
             return
 
         arch = host.get_fact(facts.server.Arch)
-        url = f"https://github.com/chatmail/filtermail/releases/download/v0.7.1/filtermail-{arch}"
+        url = f"https://github.com/chatmail/filtermail/releases/download/v0.7.4/filtermail-{arch}"
         sha256sum = {
-            "x86_64": "fc2d8141166f8561b9711fb68c5327fc9421f814c46dc69671a4605a95b175c0",
+            "x86_64": "484cb8dff083134aefba9fce4a6b7ef4784a0f0e28e5108ecf8bb9e58a44fd2c",
-            "aarch64": "37e52c5ddb373ef29b5ead89658407c53f48d10ce055a2dbd9c606fa1ebd5f7f",
+            "aarch64": "66aa0ca2ca9add7a12d92883d76f8786384092adfde24a3d3a1d0b1f30d23a9e",
         }[arch]
         self.download_executable(url, self.bin_path, sha256sum)
 

cmdeploy/src/cmdeploy/mtail/delivered_mail.mtail

@@ -73,6 +73,11 @@ counter incoming_unencrypted_mail_count
   filtered_incoming_mail_count++
 }
 
+counter incoming_mailer_daemon_mail_count
+/Incoming: Filtering mailer-daemon message from/ {
+  incoming_mailer_daemon_mail_count++
+  filtered_incoming_mail_count++
+}
 
 counter rejected_unencrypted_mail_count
 /Rejected unencrypted mail/ {

cmdeploy/src/cmdeploy/nginx/autoconfig.xml.j2

@@ -7,14 +7,14 @@
     <displayShortName>{{ config.mail_domain }}</displayShortName>
     <incomingServer type="imap">
       <hostname>{{ config.mail_domain }}</hostname>
-      <port>993</port>
+      <port>{{ config.imaps_port }}</port>
       <socketType>SSL</socketType>
       <authentication>password-cleartext</authentication>
       <username>%EMAILADDRESS%</username>
     </incomingServer>
     <incomingServer type="imap">
       <hostname>{{ config.mail_domain }}</hostname>
-      <port>143</port>
+      <port>{{ config.imap_port }}</port>
       <socketType>STARTTLS</socketType>
       <authentication>password-cleartext</authentication>
       <username>%EMAILADDRESS%</username>
@@ -28,14 +28,14 @@
     </incomingServer>
     <outgoingServer type="smtp">
       <hostname>{{ config.mail_domain }}</hostname>
-      <port>465</port>
+      <port>{{ config.smtps_port }}</port>
       <socketType>SSL</socketType>
       <authentication>password-cleartext</authentication>
       <username>%EMAILADDRESS%</username>
     </outgoingServer>
     <outgoingServer type="smtp">
       <hostname>{{ config.mail_domain }}</hostname>
-      <port>587</port>
+      <port>{{ config.smtp_port }}</port>
       <socketType>STARTTLS</socketType>
       <authentication>password-cleartext</authentication>
       <username>%EMAILADDRESS%</username>

cmdeploy/src/cmdeploy/nginx/nginx.conf.j2

@@ -31,6 +31,26 @@ stream {
             ~\bimap\b 127.0.0.1:993;
         }
 
+        server {
+                listen {{ config.smtp_port }};
+                proxy_pass 127.0.0.1:587;
+        }
+
+        server {
+                listen {{ config.imap_port }};
+                proxy_pass 127.0.0.1:143;
+        }
+
+        server {
+                listen {{ config.smtps_port }};
+                proxy_pass 127.0.0.1:465;
+        }
+
+        server {
+                listen {{ config.imaps_port }};
+                proxy_pass 127.0.0.1:993;
+        }
+
         server {
                 listen 443;
                 {% if not disable_ipv6 %}

cmdeploy/src/cmdeploy/postfix/main.cf.j2

@@ -85,6 +85,14 @@ inet_protocols = all
 
 lmtp_header_checks = regexp:/etc/postfix/lmtp_header_cleanup
 
+# Do not apply header checks to MIME headers
+# and other headers that are actually part of the message body.
+# Reference:
+# <https://www.postfix.org/postconf.5.html#disable_mime_input_processing>
+# <https://www.postfix.org/header_checks.5.html>
+# <https://stump.io/blog/2020/11/29/a-little-gotcha-with-postfixs-header_checks/>
+disable_mime_input_processing = yes
+
 mua_client_restrictions = permit_sasl_authenticated, reject
 mua_sender_restrictions = reject_sender_login_mismatch, permit_sasl_authenticated, reject
 mua_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, permit