Nice preliminary work there Kyle.
This does look interesting indeed.
Erik
On 4/4/07, Kyle Wheeler <kyle-qmail@memoryhole.net> wrote:
Hello,
I whipped up some shell scripts to do DomainKey verification and
signing, using the dktest program that comes with libdomainkeys. The
verifier is a qmail-queue wrapper, and the signer is a qmail-remote
wrapper. They aren't *optimal*, because they use temporary files,
rather than operating on just pipes. If you use `seek0`, you can avoid
that, but I figured being general was better than adding more
dependencies.
I've tested these scripts briefly, and they seem to work well. YMMV.
They do *not* block email based on DomainKey signature status; just
tag. For blocking and/or using policy information, you'll have to
modify them (for the sake of the rest of us, please post such
modifications).
The first one is dkverifier.sh:
#!/bin/sh
[ "$DKQUEUE" ] || DKQUEUE=/var/qmail/bin/qmail-queue
if printenv | grep -q '^DKVERIFY=' ; then
tmp=`mktemp -t dk.verify.XXXXXXXXXXXXXXX`
cat - >"$tmp"
( /usr/local/bin/dktest -v <"$tmp" 2>/dev/null | \
/bin/awk 'NR>1'; /bin/cat "$tmp" ) | \
$DKQUEUE
retval=$?
rm "$tmp"
exit $retval
else
exec $DKQUEUE
fi
The second one is a qmail-remote wrapper; it assumes that you've moved
qmail-remote to qmail-remote.orig, and that this script is stored in
/var/qmail/bin/qmail-remote. To set the environment variables to
control this, add them to your qmail-send run script. The script is a
little simplistic; it assumes all domains will be signed with the same
key:
#!/bin/sh
[ "$DOMAIN" ] || DOMAIN=`head -n 1 /var/qmail/control/me`
[ "$DKREMOTE" ] || DKREMOTE=/var/qmail/bin/qmail-remote.orig
[ "$DKSIGN" ] || DKSIGN="/etc/domainkeys/$DOMAIN/default"
tmp=`mktemp -t dk.sign.XXXXXXXXXXXXXXX`
cat - >"$tmp"
( /usr/local/bin/dktest -s "$DKSIGN" -c nofws -h <"$tmp" \
2>/dev/null | \
/bin/sed 's/; d=.*;/; d='"$DOMAIN"';/'; \
/bin/cat "$tmp" ) | \
"$DKREMOTE" "$@"
retval=$?
rm "$tmp"
exit $retval
We can add a little more intelligence to they key choice, at the
expense of making it a little less readable (and bash-dependent).
Like so:
#!/bin/bash
[ "$DKSIGN" ] || DKSIGN="/etc/domainkeys/%/default"
[ "$DKREMOTE" ] || DKREMOTE=/var/qmail/bin/qmail-remote.orig
if [[ $DKSIGN == *%* ]] ; then
DOMAIN=${2##*@}
DKSIGN="${DKSIGN%%%*}${DOMAIN}${DKSIGN#*%}"
fi
if [ -f "$DKSIGN" ] ; then
tmp=`mktemp -t dk.sign.XXXXXXXXXXXXXXX`
cat - >"$tmp"
( /usr/local/bin/dktest -s "$DKSIGN" -c nofws -h <"$tmp" \
2>/dev/null | \
/bin/sed 's/; d=.*;/; d='"$DOMAIN"';/'; \
/bin/cat "$tmp" ) | \
"$DKREMOTE" "$@"
retval=$?
rm "$tmp"
exit $retval
else
exec "$DKREMOTE" "$@"
fi
I hope that helps someone. :)
~Kyle
--
Those who do not understand Unix are condemned to reinvent it, poorly.
-- Henry Spencer
|