From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <daniel@firewall-services.com> Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id AB4106291C for <pmg-devel@lists.proxmox.com>; Tue, 27 Oct 2020 12:46:20 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 9E179176EF for <pmg-devel@lists.proxmox.com>; Tue, 27 Oct 2020 12:46:20 +0100 (CET) Received: from pmg.fws.fr (pmg.fws.fr [51.91.175.36]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 94336176E5 for <pmg-devel@lists.proxmox.com>; Tue, 27 Oct 2020 12:46:19 +0100 (CET) Received: from pmg.fws.fr (localhost [127.0.0.1]) by pmg.fws.fr (Proxmox) with ESMTP id 6DCB5C2074; Tue, 27 Oct 2020 12:46:13 +0100 (CET) Received: from zmproxy.fws.fr (zmproxy.fws.fr [10.29.1.17]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pmg.fws.fr (Proxmox) with ESMTPS id 7DCA6C0225; Tue, 27 Oct 2020 12:46:11 +0100 (CET) Received: from zmproxy.fws.fr (localhost [127.0.0.1]) by zmproxy.fws.fr (Postfix) with ESMTPS id 6F5D98B79C0; Tue, 27 Oct 2020 12:46:11 +0100 (CET) Received: from zmproxy.fws.fr (localhost [127.0.0.1]) by zmproxy.fws.fr (Postfix) with ESMTPS id 556AA8B79C1; Tue, 27 Oct 2020 12:46:11 +0100 (CET) DKIM-Filter: OpenDKIM Filter v2.10.3 zmproxy.fws.fr 556AA8B79C1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=firewall-services.com; s=7DAD15A2-D84A-11E9-8F77-BEC4FAA34EBC; t=1603799171; bh=vnXMPzgEFf+/9eP5C+/IIMX3/qRq2F51B0pLfLkKYXs=; h=Date:From:To:Message-ID:MIME-Version; b=LpdJ858ZRlkZXIZr0LdUp/hQ+55HfvJSnWFv6c6zYjc748nuDQP4jZgKxPpK/I5mD u2rf34yeT67Jim8TEVcNLASrEPn10oEOKskzDZmTKfF/rAk/gw9iRZwMUK6Y3tSsE7 A/I2RT4pUfL1tSQEMFWLfgig1N2Nf1+GsaZlF4woyoJlwy3HYC72iaxesdg1nCvXkM 5Vw0CqUn92QZ7gY6eqgU7Gl3m3j1EinVQG/xHOw6MWgx+WrMiDvpQ7EMPyrd+tnFot l5sWvjT5YEtWWI3FDSCoLHFe5PZYb81cWpAb27A/8jTcMdKCxysiRJFs8Rpbfh1N91 r+zvYR/uvzkYw== Received: from zmstore.fws.fr (zmstore.fws.fr [10.29.3.15]) by zmproxy.fws.fr (Postfix) with ESMTP id 4DB8A8B79C0; Tue, 27 Oct 2020 12:46:11 +0100 (CET) Date: Tue, 27 Oct 2020 12:46:11 +0100 (CET) From: Daniel Berteaud <daniel@firewall-services.com> To: Stoiko Ivanov <s.ivanov@proxmox.com> Cc: pmg-devel@lists.proxmox.com Message-ID: <335488398.2528.1603799171114.JavaMail.zimbra@fws.fr> In-Reply-To: <20201027123901.0117e0a5@rosa.proxmox.com> References: <20201026105046.424454-1-daniel@firewall-services.com> <20201026105046.424454-2-daniel@firewall-services.com> <20201027123901.0117e0a5@rosa.proxmox.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.29.1.17] X-Mailer: Zimbra 8.8.15_GA_3975 (ZimbraWebClient - GC86 (Linux)/8.8.15_GA_3975) Thread-Topic: : fix #3098 : first check for exact domain match Thread-Index: nGCkPFStm9eFt/K+mKhw4tfIK61tsg== X-SPAM-LEVEL: Spam detection results: 0 AWL 0.011 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [firewall-services.com, fws.fr] Subject: Re: [pmg-devel] [PATCH pmg-api 1/1] [pmg-api]: fix #3098 : first check for exact domain match X-BeenThere: pmg-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Mail Gateway development discussion <pmg-devel.lists.proxmox.com> List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pmg-devel>, <mailto:pmg-devel-request@lists.proxmox.com?subject=unsubscribe> List-Archive: <http://lists.proxmox.com/pipermail/pmg-devel/> List-Post: <mailto:pmg-devel@lists.proxmox.com> List-Help: <mailto:pmg-devel-request@lists.proxmox.com?subject=help> List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel>, <mailto:pmg-devel-request@lists.proxmox.com?subject=subscribe> X-List-Received-Date: Tue, 27 Oct 2020 11:46:20 -0000 ----- Le 27 Oct 20, =C3=A0 12:39, Stoiko Ivanov s.ivanov@proxmox.com a =C3= =A9crit : > Hi, >=20 > Thank you very much for catching this, opening a report and directly > providing a patch! >=20 > The patch works as advertised (gave it a quick spin on my test-setup). >=20 > However I wonder if it wouldn't be better to address this by sorting > properly - instead of differentiating between exact match and first > matching subdomain we could match for the longest matching subdomain > (suggestion inline). > This should cover your issue as well as far as I can tell, and provide > fewer suprises regarding the chosen signing domain. >=20 > What do you think? I'll give your proposal a try and report back (my perl sort-fu is a bit rus= ty :-) ) Cheers, Daniel --=20 [ https://www.firewall-services.com/ ] =09 Daniel Berteaud=20 FIREWALL-SERVICES SAS, La s=C3=A9curit=C3=A9 des r=C3=A9seaux=20 Soci=C3=A9t=C3=A9 de Services en Logiciels Libres=20 T=C3=A9l : +33.5 56 64 15 32=20 Matrix: @dani:fws.fr=20 [ https://www.firewall-services.com/ | https://www.firewall-services.com ]