feat: use daemon_name for OpenDKIM sign-verify decision instead of IP#784
feat: use daemon_name for OpenDKIM sign-verify decision instead of IP#784
Conversation
|
If this does not fail I tested in #783 that the test works. |
| MTA ORIGINATING | ||
|
|
||
| # No hosts are treated as internal, ORIGINATING daemon name should be set explicitly. | ||
| InternalHosts - |
There was a problem hiding this comment.
This - is used in some OpenDKIM tests:
https://github.com/trusteddomainproject/OpenDKIM/blob/master/opendkim/tests/t-sign-ss-macro.conf#L9
| -o smtpd_sender_restrictions=$mua_sender_restrictions | ||
| -o smtpd_recipient_restrictions= | ||
| -o smtpd_relay_restrictions=permit_sasl_authenticated,reject | ||
| -o milter_macro_daemon_name=ORIGINATING |
There was a problem hiding this comment.
This is unused because there is no milter.
| -o smtpd_recipient_restrictions= | ||
| -o smtpd_relay_restrictions=permit_sasl_authenticated,reject | ||
| -o smtpd_client_connection_count_limit=1000 | ||
| -o milter_macro_daemon_name=ORIGINATING |
There was a problem hiding this comment.
This was also unused, it's just a cleanup.
|
This is supposed to work: http://www.trusteddomain.org/pipermail/opendmarc-users/2013-June/000153.html Here is the source code where |
|
Seems the problem is that all the OUTGOING stuff works, but final.lua runs even for outgoing messages and this does not work anymore: relay/cmdeploy/src/cmdeploy/opendkim/final.lua Lines 1 to 5 in 7191329 We should not use |
51a95c6 to
906c255
Compare
On FreeBSD 127.0.0.2 is not assigned to any interface by default,
so 127.0.0.2 source address hack cannot be used to make OpenDKIM
verify the signature instead of signing.
This change sets InternalHosts to `-` so no IP addresses
make OpenDKIM sign the message. Instead of IP address,
OpenDKIM in the outgoing pipeline is explicitly told
to sign messages by setting `{daemon_name}` macro to `ORIGINATING`.
906c255 to
34ce54a
Compare
On FreeBSD 127.0.0.2 is not assigned to any interface by default,
so 127.0.0.2 source address hack cannot be used to make OpenDKIM
verify the signature instead of signing.
This change sets InternalHosts to
-so no IP addressesmake OpenDKIM sign the message. Instead of IP address,
OpenDKIM in the outgoing pipeline is explicitly told
to sign messages by setting
{daemon_name}macro toORIGINATING.This is a replacement for #778