Source: exim4 Source-Version: 4.92.2-2 Severity: important Tags: patch Hi!
The default DKIM_SIGN_HEADERS macro contains many headers that make sending mails to mailing lists or (re)sending mails on someone's behalf pretty much infeasible. This has big impact on systems with strict DKIM and DMARC policies. There are several of the listed fields that are intended to be set by the system resending a mail, be that a mailing list or a third-party. If these fields are listed in the default set it means any mail going through those systems will contain a signature for an empty header, which will then be filled and fail signature validatation. Moreover the RFC4871 and RFC6376 in their §5.4 section mentions that signing missing fields should be done carefully. Mark Sender and all Resent-* and List-* fields to only be signed if present. Add also duplicate entries for the From and Subject fields, to reject appended fields. There's a related write up at <https://begriffs.com/posts/2018-09-18-dmarc-mailing-list.html>. I'm attaching a patch that should fix this. Thanks, Guillem
Description: Fix default DKIM_SIGN_HEADERS macro. There are several of the listed fields that are intended to be set by the system resending a mail, be that a mailing list or a third-party. If these fields are listed in the default set it means any mail going through those systems will contain a signature for an empty header, which will then be filled and fail signature validate. Moreover the RFC4871 and RFC6376 in their §5.4 section mentions that signing missing fields should be done carefully. . Add also duplicate entries for the From and Subject fields, to reject appended fields. Author: Guillem Jover <[email protected]> Last-Update: 2019-09-08 --- src/pdkim/pdkim.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) --- a/src/pdkim/pdkim.h +++ b/src/pdkim/pdkim.h @@ -26,14 +26,14 @@ #include "../blob.h" #include "../hash.h" -#define PDKIM_DEFAULT_SIGN_HEADERS "From:Sender:Reply-To:Subject:Date:"\ - "Message-ID:To:Cc:MIME-Version:Content-Type:"\ - "Content-Transfer-Encoding:Content-ID:"\ - "Content-Description:Resent-Date:Resent-From:"\ - "Resent-Sender:Resent-To:Resent-Cc:"\ - "Resent-Message-ID:In-Reply-To:References:"\ - "List-Id:List-Help:List-Unsubscribe:"\ - "List-Subscribe:List-Post:List-Owner:List-Archive" +#define PDKIM_DEFAULT_SIGN_HEADERS \ + "From:From:=Sender:Reply-To:Subject:Subject:Date:To:Cc:"\ + "Message-ID:In-Reply-To:References:MIME-Version:"\ + "Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:"\ + "=Resent-Date:=Resent-From:=Resent-Sender:=Resent-To:=Resent-Cc:"\ + "=Resent-Message-ID:"\ + "=List-Id:=List-Help:=List-Unsubscribe:=List-Subscribe:=List-Post:"\ + "=List-Owner:=List-Archive" /* -------------------------------------------------------------------------- */ /* Length of the preallocated buffer for the "answer" from the dns/txt
