head 1.3; access; symbols pkgsrc-2022Q1:1.2.0.8 pkgsrc-2022Q1-base:1.2 pkgsrc-2021Q4:1.2.0.6 pkgsrc-2021Q4-base:1.2 pkgsrc-2021Q3:1.2.0.4 pkgsrc-2021Q3-base:1.2 pkgsrc-2021Q2:1.2.0.2 pkgsrc-2021Q2-base:1.2 pkgsrc-2021Q1:1.1.0.2 pkgsrc-2021Q1-base:1.1; locks; strict; comment @# @; 1.3 date 2022.05.12.13.49.28; author jperkin; state dead; branches; next 1.2; commitid 9WqyyuNxe71AQLDD; 1.2 date 2021.05.27.16.52.00; author manu; state Exp; branches; next 1.1; commitid v479E0QMAMUp8OUC; 1.1 date 2021.03.29.09.30.59; author manu; state Exp; branches; next ; commitid hrpMtam4XQVuAbNC; desc @@ 1.3 log @opendmarc: Update to 1.4.2 and overhaul package. pkgsrc changes: * Use PKG_SYSCONFSUBDIR, there are a number of extra files supported in the configuration file so everything should live in a sub-directory. HEADS-UP! Users will need to migrate over to new config file location. * Create opendmarc user/group, not currently used in rc.d script. * Fix build on SunOS and add SMF support. * Split multi-file patch correctly into separate files. * Add TEST_TARGET. * Various pkglint and cleanup. opendmarc changes: 1.4.2 2021/12/19 Fix issue #175: Don't reject a multi-valued From when all of the domains match. Fix issue #179: Don't crash when a value in a multi-valued From field is missing a domain name. Resolves CVE-2021-34555. @ text @$NetBSD: patch-RequiredFrom,v 1.2 2021/05/27 16:52:00 manu Exp $ Add RequiredFrom option to reject messages that lack a From header from which a valid domain can be extracted Submitted upstream as https://github.com/trusteddomainproject/OpenDMARC/pull/147 --- ./opendmarc/opendmarc.c.orig 2021-04-30 18:34:43.000000000 +0200 +++ ./opendmarc/opendmarc.c 2021-05-27 10:20:33.880652427 +0200 @@@@ -163,8 +163,9 @@@@ /* DMARCF_CONFIG -- configuration object */ struct dmarcf_config { _Bool conf_reqhdrs; + _Bool conf_reqfrom; _Bool conf_afrf; _Bool conf_afrfnone; _Bool conf_rejectfail; _Bool conf_dolog; @@@@ -1422,8 +1423,12 @@@@ (void) config_get(data, "RequiredHeaders", &conf->conf_reqhdrs, sizeof conf->conf_reqhdrs); + (void) config_get(data, "RequiredFrom", + &conf->conf_reqfrom, + sizeof conf->conf_reqfrom); + (void) config_get(data, "FailureReports", &conf->conf_afrf, sizeof conf->conf_afrf); @@@@ -2453,13 +2458,17 @@@@ { if (conf->conf_dolog) { syslog(LOG_INFO, - "%s: RFC5322 requirement error: missing From field; accepting", - dfc->mctx_jobid); + "%s: RFC5322 requirement error: missing From field; %s", + dfc->mctx_jobid, + conf->conf_reqfrom ? "reject" : "accepting"); } - return SMFIS_ACCEPT; + if (conf->conf_reqfrom) + return SMFIS_REJECT; + else + return SMFIS_ACCEPT; } /* extract From: addresses */ memset(addrbuf, '\0', sizeof addrbuf); @@@@ -2495,13 +2504,13 @@@@ { if (conf->conf_dolog) { syslog(LOG_ERR, - "%s: unable to parse From header field", - dfc->mctx_jobid); + "%s: unable to parse From header field \"%s\"", + dfc->mctx_jobid, from->hdr_value); } - if (conf->conf_reqhdrs) + if (conf->conf_reqhdrs || conf->conf_reqfrom) return SMFIS_REJECT; else return SMFIS_ACCEPT; } --- ./opendmarc/opendmarc.conf.5.in.orig 2021-04-30 18:34:43.000000000 +0200 +++ ./opendmarc/opendmarc.conf.5.in 2021-05-27 10:20:33.881043733 +0200 @@@@ -287,8 +287,16 @@@@ failing this test are rejected without further processing. A From: field from which no domain name could be extracted will also be rejected. .TP +.I RequiredFrom (Boolean) +If set, the filter will reject without further processing messages that lack a +From: field from which a domain name could be extracted. This options is +without effect if +.I RequiredHeaders +is set to "true". + +.TP .I Socket (string) Specifies the socket that should be established by the filter to receive connections from .I sendmail(8) --- ./opendmarc/opendmarc-config.h.orig 2021-04-30 18:34:43.000000000 +0200 +++ ./opendmarc/opendmarc-config.h 2021-05-27 10:23:12.866999966 +0200 @@@@ -44,8 +44,9 @@@@ { "PidFile", CONFIG_TYPE_STRING, FALSE }, { "PublicSuffixList", CONFIG_TYPE_STRING, FALSE }, { "RecordAllMessages", CONFIG_TYPE_BOOLEAN, FALSE }, { "RequiredHeaders", CONFIG_TYPE_BOOLEAN, FALSE }, + { "RequiredFrom", CONFIG_TYPE_BOOLEAN, FALSE }, { "RejectFailures", CONFIG_TYPE_BOOLEAN, FALSE }, { "RejectMultiValueFrom", CONFIG_TYPE_BOOLEAN, FALSE }, { "ReportCommand", CONFIG_TYPE_STRING, FALSE }, { "Socket", CONFIG_TYPE_STRING, FALSE }, --- ./opendmarc/opendmarc.conf.sample.orig 2021-04-30 18:34:43.000000000 +0200 +++ ./opendmarc/opendmarc.conf.sample 2021-05-27 10:20:33.882715995 +0200 @@@@ -343,8 +343,17 @@@@ ## rejected. # # RequiredHeaders false +## RequiredFrom { true | false } +## default "false" +## +## If set, the filter will reject without further processing messages that +## lack a From: field from which a domain name could be extracted. This +## options is without effect if RequiredHeaders is set to "true". +# +# RequiredFrom false + ## Socket socketspec ## default (none) ## ## Specifies the socket that should be established by the filter to receive @ 1.2 log @Update mail/opendmarc to 1.4.1.1 Changes since 1.4.0 from the RELEASE_NOTES file NOTE: In response to CVE-2019-20790, opendmarc has changed how it evaluates headers added by previous SPF milters. Users are encouraged to read the CVE-2019-20790 file in the "SECURITY" folder for more details. (#49, #158). Originally reported by Jianjun Chen, feedback by Simon Wilson and David Bürgin . NOTE: OpenDMARC's internal SPF handling will be removed in a future version. Users are encouraged to build linked against libspf2. Many pre-built packages provided by OS packagers already do this. (See https://www.libspf2.org) Addition of defines for MUSL C Library. (#129/#133). Patches by Marco Rebhan. Updated opendmarc.conf manpage and opendmarc.conf.sample to point to https://publicsuffix.org/list/. Added a CONTRIBUTING document. Fix two #ifdefs in arc functions for strlcpy. (#138). Reported by Leo Bicknell. Fixes to MySQL Schema (#98/#99). Patch by Bond Keevil. LIBSPF2 calls would not compile on OpenBSD due to OpenBSD not having the ns_type definition in arpa/resolv.h. Added detection to configure script. (#134) Reworked hcreate_r calls to use hcreate, to compile natively on OpenBSD and MacOS. (Part of #94) Reported by Rupert Gallagher. Add compatibility with AutoConf 2.70. (#95) Documentation updates about SourceForge being deprecated. (#101) Only accept results from Received-SPF fields that indicate clearly which identifier was being evaluated, since DMARC specifically only wants results based on MAIL FROM. Many build-time fixes (#100, #91, #90, #86, #85, #84, #83, #82, #81) Patches provided by Rupert Gallagher (ruga@@protonmail.com) Added config option HoldQuarantinedMessages (default false), which controls if messages with p=quarantine will be passed on to the mail stream (if False) or placed in the MTA's "hold" queue (if True). Issue #105. Patch by Marcos Moraes, on the OpenDMARC mailing list. Remove "--with-wall" from "configure". Suggested by Leo Bicknell. LIBOPENDMARC: Fix bug #50: Ignore all RRTYPEs other than TXT. Problem reported by Jan Bouwhuis. LIBOPENDMARC: Fix bug #89: Repair absurd RRTYPE test in SPF code. LIBOPENDMARC: Fix bug #104: Fix bogus header field parsing code. LIBOPENDMARC: Fix bug #161: Don't pass the client IP address through htonl() since it's already in network byte order. This was causing SPF errors when the internal SPF implementation was in use. LIBOPENDMARC: Fix numerous problems with the internal SPF implementation. @ text @d1 1 a1 1 $NetBSD$ @ 1.1 log @Add RequiredFrom option If RequiredFrom is set, opendmarc will reject messages that lack a From header from which a valid domain can be extracted. This is a subset of the full RFC5322 requirements enforced by the RequiredHeaders option. While non RFC5322-compliant messages are too common to make RequiredHeaders always usable, the check on the From header remains especially valuable. It makes sure forged domain messages cannot evade the filter by just omitting the From header and relying on the MTA to fill it by a copy from the enveloppe header. Submitted upstream as https://github.com/trusteddomainproject/OpenDMARC/pull/147 @ text @d9 2 a10 2 --- opendmarc/opendmarc.c.orig 2021-03-29 09:13:11.534047039 +0200 +++ opendmarc/opendmarc.c 2021-03-29 10:02:01.105977120 +0200 d21 1 a21 1 @@@@ -1349,8 +1350,12 @@@@ d34 1 a34 1 @@@@ -2367,13 +2372,17 @@@@ d53 1 a53 1 /* extract From: domain */ d55 9 a63 3 @@@@ -2387,9 +2396,9 @@@@ "%s: unable to parse From header field", dfc->mctx_jobid); d72 3 a74 3 --- opendmarc/opendmarc.conf.5.in.orig 2021-03-29 09:15:03.877101090 +0200 +++ opendmarc/opendmarc.conf.5.in 2021-03-29 09:21:56.423837778 +0200 @@@@ -258,8 +258,16 @@@@ d91 3 a93 3 --- opendmarc/opendmarc-config.h.orig 2021-03-29 09:19:21.345035861 +0200 +++ opendmarc/opendmarc-config.h 2021-03-29 09:19:34.235736167 +0200 @@@@ -43,8 +43,9 @@@@ d100 1 d103 3 a105 4 { "SoftwareHeader", CONFIG_TYPE_BOOLEAN, FALSE }, --- opendmarc/opendmarc.conf.sample.orig 2021-03-29 09:19:43.400961620 +0200 +++ opendmarc/opendmarc.conf.sample 2021-03-29 09:22:23.834032438 +0200 @@@@ -303,8 +303,17 @@@@ @