pkgsrc-Changes-HG archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

[pkgsrc/trunk]: pkgsrc/mail/opendmarc Add RequiredFrom option



details:   https://anonhg.NetBSD.org/pkgsrc/rev/f3838f9eadf2
branches:  trunk
changeset: 449383:f3838f9eadf2
user:      manu <manu%pkgsrc.org@localhost>
date:      Mon Mar 29 09:30:59 2021 +0000

description:
Add RequiredFrom option

If RequiredFrom is set, opendmarc will reject messages that lack
a From header from which a valid domain can be extracted. This
is a subset of the full RFC5322 requirements enforced by the
RequiredHeaders option.

While non RFC5322-compliant messages are too common to make
RequiredHeaders always usable, the check on the From header
remains especially valuable. It makes sure forged domain messages
cannot evade the filter by just omitting the From header and relying
on the MTA to fill it by a copy from the enveloppe header.

Submitted upstream as
https://github.com/trusteddomainproject/OpenDMARC/pull/147

diffstat:

 mail/opendmarc/Makefile                   |    4 +-
 mail/opendmarc/distinfo                   |    3 +-
 mail/opendmarc/patches/patch-RequiredFrom |  116 ++++++++++++++++++++++++++++++
 3 files changed, 120 insertions(+), 3 deletions(-)

diffs (151 lines):

diff -r dd7cad76b17e -r f3838f9eadf2 mail/opendmarc/Makefile
--- a/mail/opendmarc/Makefile   Mon Mar 29 08:45:48 2021 +0000
+++ b/mail/opendmarc/Makefile   Mon Mar 29 09:30:59 2021 +0000
@@ -1,10 +1,10 @@
-# $NetBSD: Makefile,v 1.23 2021/02/17 01:49:12 manu Exp $
+# $NetBSD: Makefile,v 1.24 2021/03/29 09:30:59 manu Exp $
 
 GITHUB_PROJECT=        OpenDMARC
 GITHUB_TAG=    rel-opendmarc-1-4-0-Beta1
 DISTNAME=      rel-opendmarc-1-4-0-Beta1
 PKGNAME=       opendmarc-1.4.0b1
-PKGREVISION=   1
+PKGREVISION=   3
 CATEGORIES=    mail
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=trusteddomainproject/}
 DIST_SUBDIR=   ${GITHUB_PROJECT}
diff -r dd7cad76b17e -r f3838f9eadf2 mail/opendmarc/distinfo
--- a/mail/opendmarc/distinfo   Mon Mar 29 08:45:48 2021 +0000
+++ b/mail/opendmarc/distinfo   Mon Mar 29 09:30:59 2021 +0000
@@ -1,9 +1,10 @@
-$NetBSD: distinfo,v 1.9 2021/02/17 01:49:12 manu Exp $
+$NetBSD: distinfo,v 1.10 2021/03/29 09:30:59 manu Exp $
 
 SHA1 (OpenDMARC/rel-opendmarc-1-4-0-Beta1.tar.gz) = 74ad1ef9f9a12b5fadef5919807cd55f7655d8d8
 RMD160 (OpenDMARC/rel-opendmarc-1-4-0-Beta1.tar.gz) = e8dda5350a734509843a04329777478d9410b796
 SHA512 (OpenDMARC/rel-opendmarc-1-4-0-Beta1.tar.gz) = d562050da9c4b96e7707157fbbf385ab3ac551cf07754b45deb6a010b4c47e7f478dfe35bc2c8625f6553af4fbf120820bf2a9f0ce246b26cabf81e7d1174405
 Size (OpenDMARC/rel-opendmarc-1-4-0-Beta1.tar.gz) = 1247386 bytes
+SHA1 (patch-RequiredFrom) = a21d77abbe93c806c6abee55e77e477c9c435c00
 SHA1 (patch-configure.ac) = d174911e4de37d3b50b525469cbe410bb7ae119f
 SHA1 (patch-libopendmarc_opendmarc__dns.c) = e76ca13707677525b72609b4a5268d77efcfba84
 SHA1 (patch-libopendmarc_opendmarc__spf__dns.c) = b6e1311be8e9ef44c333be57fef474f6b080a199
diff -r dd7cad76b17e -r f3838f9eadf2 mail/opendmarc/patches/patch-RequiredFrom
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/mail/opendmarc/patches/patch-RequiredFrom Mon Mar 29 09:30:59 2021 +0000
@@ -0,0 +1,116 @@
+$NetBSD: patch-RequiredFrom,v 1.1 2021/03/29 09:30:59 manu Exp $
+
+Add RequiredFrom option to reject messages that lack a From header
+from which a valid domain can be extracted
+
+Submitted upstream as 
+https://github.com/trusteddomainproject/OpenDMARC/pull/147
+
+--- opendmarc/opendmarc.c.orig 2021-03-29 09:13:11.534047039 +0200
++++ opendmarc/opendmarc.c      2021-03-29 10:02:01.105977120 +0200
+@@ -163,8 +163,9 @@
+ /* DMARCF_CONFIG -- configuration object */
+ struct dmarcf_config
+ {
+       _Bool                   conf_reqhdrs;
++      _Bool                   conf_reqfrom;
+       _Bool                   conf_afrf;
+       _Bool                   conf_afrfnone;
+       _Bool                   conf_rejectfail;
+       _Bool                   conf_dolog;
+@@ -1349,8 +1350,12 @@
+               (void) config_get(data, "RequiredHeaders",
+                                 &conf->conf_reqhdrs,
+                                 sizeof conf->conf_reqhdrs);
+ 
++              (void) config_get(data, "RequiredFrom",
++                                &conf->conf_reqfrom,
++                                sizeof conf->conf_reqfrom);
++
+               (void) config_get(data, "FailureReports",
+                                 &conf->conf_afrf,
+                                 sizeof conf->conf_afrf);
+ 
+@@ -2367,13 +2372,17 @@
+       {
+               if (conf->conf_dolog)
+               {
+                       syslog(LOG_INFO,
+-                             "%s: RFC5322 requirement error: missing From field; accepting",
+-                             dfc->mctx_jobid);
++                             "%s: RFC5322 requirement error: missing From field; %s",
++                             dfc->mctx_jobid,
++                             conf->conf_reqfrom ? "reject" : "accepting");
+               }
+ 
+-              return SMFIS_ACCEPT;
++              if (conf->conf_reqfrom)
++                      return SMFIS_REJECT;
++              else
++                      return SMFIS_ACCEPT;
+       }
+ 
+       /* extract From: domain */
+       memset(addrbuf, '\0', sizeof addrbuf);
+@@ -2387,9 +2396,9 @@
+                              "%s: unable to parse From header field",
+                              dfc->mctx_jobid);
+               }
+ 
+-              if (conf->conf_reqhdrs)
++              if (conf->conf_reqhdrs || conf->conf_reqfrom) 
+                       return SMFIS_REJECT;
+               else
+                       return SMFIS_ACCEPT;
+       }
+--- opendmarc/opendmarc.conf.5.in.orig 2021-03-29 09:15:03.877101090 +0200
++++ opendmarc/opendmarc.conf.5.in      2021-03-29 09:21:56.423837778 +0200
+@@ -258,8 +258,16 @@
+ failing this test are rejected without further processing.  A From:
+ field from which no domain name could be extracted will also be rejected.
+ 
+ .TP
++.I RequiredFrom (Boolean)
++If set, the filter will reject without further processing messages that lack a
++From: field from which a domain name could be extracted. This options is
++without effect if
++.I RequiredHeaders
++is set to "true".
++
++.TP
+ .I Socket (string)
+ Specifies the socket that should be established by the filter to receive
+ connections from
+ .I sendmail(8)
+--- opendmarc/opendmarc-config.h.orig  2021-03-29 09:19:21.345035861 +0200
++++ opendmarc/opendmarc-config.h       2021-03-29 09:19:34.235736167 +0200
+@@ -43,8 +43,9 @@
+       { "PidFile",                    CONFIG_TYPE_STRING,     FALSE },
+       { "PublicSuffixList",           CONFIG_TYPE_STRING,     FALSE },
+       { "RecordAllMessages",          CONFIG_TYPE_BOOLEAN,    FALSE },
+       { "RequiredHeaders",            CONFIG_TYPE_BOOLEAN,    FALSE },
++      { "RequiredFrom",               CONFIG_TYPE_BOOLEAN,    FALSE },
+       { "RejectFailures",             CONFIG_TYPE_BOOLEAN,    FALSE },
+       { "ReportCommand",              CONFIG_TYPE_STRING,     FALSE },
+       { "Socket",                     CONFIG_TYPE_STRING,     FALSE },
+       { "SoftwareHeader",             CONFIG_TYPE_BOOLEAN,    FALSE },
+--- opendmarc/opendmarc.conf.sample.orig       2021-03-29 09:19:43.400961620 +0200
++++ opendmarc/opendmarc.conf.sample    2021-03-29 09:22:23.834032438 +0200
+@@ -303,8 +303,17 @@
+ ##  rejected.
+ #
+ # RequiredHeaders false
+ 
++##  RequiredFrom { true | false }
++##    default "false"
++##
++##  If set, the filter will reject without further processing messages that 
++##  lack a From: field from which a domain name could be extracted. This 
++##  options is without effect if RequiredHeaders is set to "true".
++#
++# RequiredFrom false
++
+ ##  Socket socketspec
+ ##    default (none)
+ ##
+ ##  Specifies the socket that should be established by the filter to receive



Home | Main Index | Thread Index | Old Index