]> git.proxmox.com Git - pmg-api.git/commit
fix #2971: DKIM: add setting to use From header when signing
authorMaximiliano Sandoval <m.sandoval@proxmox.com>
Mon, 26 Feb 2024 14:03:02 +0000 (15:03 +0100)
committerStoiko Ivanov <s.ivanov@proxmox.com>
Mon, 26 Feb 2024 14:31:00 +0000 (15:31 +0100)
commitdbabc1f9f72a7ec10d7ffc45e98a22a7c46ef15f
treeea2fd8951f9d5bd312203372c2eeb2572d4f240f
parent9bb0ac5d254ad11450bd281538ad31e6fa0521ae
fix #2971: DKIM: add setting to use From header when signing

Following RFC 5322 [2], we add an option to use the address from the
`From:` header instead of the Envelope From address.

From RFC 7489 [1]:

   To illustrate, in relaxed mode, if a validated DKIM signature
   successfully verifies with a "d=" domain of "example.com", and the
   RFC5322.From address is "alerts@news.example.com", the DKIM "d="
   domain and the RFC5322.From domain are considered to be "in
   alignment".  In strict mode, this test would fail, since the "d="
   domain does not exactly match the FQDN of the address.

Tested with the following command:

    swaks --from foo@envelope.domain --to EMAIL -s PMG_ADDR:26 --data "Date: %DATE%\nTo: %TO_ADDRESS%\nFrom: bar@header.domain\nSubject: test %DATE%\nMessage-Id: <%MESSAGEID%>\nX-Mailer: swaks v%SWAKS_VERSION% jetmore.org/john/code/swaks/\n%NEW_HEADERS%\n%BODY%\n"

Where EMAIL and PMG_ADDR are given adequate values, and envelope.domain
and header.domain are in the 'Sign Domains' list.

[1] https://datatracker.ietf.org/doc/html/rfc7489#section-3.1.1
[2] https://datatracker.ietf.org/doc/html/rfc5322#section-3.6.2

Signed-off-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
src/PMG/Config.pm
src/PMG/DKIMSign.pm
src/PMG/RuleDB/Accept.pm
src/PMG/RuleDB/BCC.pm
src/bin/pmg-smtp-filter