search

trusteddomainproject / OpenDKIM

Other
97 stars 52 forks source link

The consistency check of SigningTable and KeyTable on loading config load does not work properly #229

Open futatuki opened 1 month ago

futatuki commented 1 month ago

If SigingTable and KeyTable is specified in config file and the dataset type of SigningTable has capability of db walk operation, opendkim milter performs consistency check on loading config file, for each entry in SigningTable if the keyname specified by the entry exists in KeyTable.

However while retrieving a SigningTable entry, it does not check error status on dkimf_db_walk() . https://github.com/trusteddomainproject/OpenDKIM/blob/835834ea6434f2dc37e162181afdef4a38cbfa86/opendkim/opendkim.c#L8348-L8349 So if there exists an bogus entry that causes error in SigingTable, the check would finish without error here, and rest of records in SigningTables does not checked.

Also, although the second field in values in SigningTable should be optional, it does not treat them in the consistency check above. https://github.com/trusteddomainproject/OpenDKIM/blob/835834ea6434f2dc37e162181afdef4a38cbfa86/opendkim/opendkim.c#L8341-L8349

e.g. a flat file SigningTable like below would not be checked at all:

foo.example.org     default._domainkey.foo.example.org
bar@foo.example.org bar.default._domainkey.foo.example.org:bar@foo.example.org
baz.example.com     default._domainkey.baz.example.com:@baz.example.com