Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1364730 - DKIM signing of originating mail stopped working after upgrade from 2.10.1-5 to 2.11.0-3
Summary: DKIM signing of originating mail stopped working after upgrade from 2.10.1-5 ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: amavisd-new
Version: 24
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Juan Orti Alcaine
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-06 17:45 UTC by Matt Kinni
Modified: 2016-08-27 10:23 UTC (History)
4 users (show)

Fixed In Version: amavisd-new-2.11.0-4.fc24
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-26 10:22:14 UTC


Attachments (Terms of Use)
Patch file from https://lists.amavis.org/pipermail/amavis-users/2016-July/004428.html (deleted)
2016-08-06 17:45 UTC, Matt Kinni
no flags Details | Diff

Description Matt Kinni 2016-08-06 17:45:18 UTC
Created attachment 1188215 [details]
Patch file from https://lists.amavis.org/pipermail/amavis-users/2016-July/004428.html

Description of problem:

Hello, after updating to the latest amavisd-new package I noticed that DKIM signing no longer works with existing configs.

Running amavisd-new in debug mode, I can confirm that locally generated mail (in this example sent from root to another local user) is getting routed to the corrected port for the ORIGINATING policy bank (10026):

Aug  6 18:36:05.865 cipixia.com /usr/sbin/amavisd[2709]: (02709-01) LMTP :10026 /var/spool/amavisd/tmp/amavis-20160806T183605-02709-mYQagKcY: <root@cipixia.com> -> <matt@localhost.com> Received: from cipixia.com ([127.0.0.1]) by localhost (cipixia.com [127.0.0.1]) (amavisd-new, port 10026) with LMTP for <matt@localhost.com>; Sat,  6 Aug 2016 18:36:05 +0200 (CEST)

but then a little bit later it decides that the mail is not considered originating (relevant bits pasted from log):

Aug  6 18:36:05.905 cipixia.com /usr/sbin/amavisd[2709]: (02709-01) Checking: wVqqBSZuYzR0 ORIGINATING [127.0.0.1] <root@cipixia.com> -> <matt@localhost.com>
...
...
Aug  6 18:36:05.906 cipixia.com /usr/sbin/amavisd[2709]: (02709-01) Open relay? Nonlocal recips but not originating: matt@localhost.com
...
...
Aug  6 18:36:05.931 cipixia.com /usr/sbin/amavisd[2709]: (02709-01) dkim: not signing mail which is not originating from our site


I Googled around and found this relevant post on the amavisd-new mailing list, which actually solved my problem:
https://lists.amavis.org/pipermail/amavis-users/2016-July/004428.html

In the related message, Giovanni provides a simple patch for /usr/sbin/amavisd that restores expected functionality.

I tested this patch against my current amavisd-new install by applying it like so:
patch -b /usr/sbin/amavisd < /tmp/amavisd_dkim_fix.patch 

I then reran the the same test as before by sending an email from root to another localhost user with amavisd-new in debug mode, and the output now shows the expected behavior:

Aug  6 18:44:48.246 cipixia.com /usr/sbin/amavisd[2882]: (02882-01) LMTP :10026 /var/spool/amavisd/tmp/amavis-20160806T184448-02882-LhR01zY9: <root@cipixia.com> -> <matt@localhost.com> Received: from cipixia.com ([127.0.0.1]) by localhost (cipixia.com [127.0.0.1]) (amavisd-new, port 10026) with LMTP for <matt@localhost.com>; Sat,  6 Aug 2016 18:44:48 +0200 (CEST)
...
...
Aug  6 18:44:48.286 cipixia.com /usr/sbin/amavisd[2882]: (02882-01) Checking: r89s629QBf_0 ORIGINATING [127.0.0.1] <root@cipixia.com> -> <matt@localhost.com>
...
...
Aug  6 18:44:48.309 cipixia.com /usr/sbin/amavisd[2882]: (02882-01) dkim: candidate originators: From:<root@cipixia.com>
..
..
Aug  6 18:44:48.310 cipixia.com /usr/sbin/amavisd[2882]: (02882-01) dkim: signing (author), From: <root@cipixia.com> (From:<root@cipixia.com>), KEY.key_ind=>0, a=>rsa-sha256, c=>relaxed/simple, d=>cipixia.com, s=>dkimkey, ttl=>1814400, x=>1472316289

and so on.

I am not subscribed to the amavisd user's mailing list so I'm not sure if the upstream developers have responded to or acknowledged Giovanni's message, but his patch worked for me and solved the issue.


Version-Release number of selected component (if applicable):
amavisd-new-2.11.0-3.fc24.noarch

How reproducible:
Always


Steps to Reproduce:
1.  Setup dkim signing for the originating policy bank
2.  Verify in the logs that your test mail is being routed to the correct port
3.  Observe that dkim signing is not performed and the message is not considered "local", despite being in the right policy bank

Actual results:
No dkim signing, log messages indicate local mail is not considered as originating.


Expected results:
Dkim signing performed and triggered by ORIGINATING mail


Additional info:
I've attached the patch from the mailing list to this bug, for convenience

Comment 1 Fedora Update System 2016-08-18 09:48:31 UTC
amavisd-new-2.11.0-4.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2016-0ff4ff1572

Comment 2 Fedora Update System 2016-08-18 09:58:50 UTC
amavisd-new-2.11.0-4.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-e2ac9d7455

Comment 3 Fedora Update System 2016-08-18 10:06:24 UTC
amavisd-new-2.11.0-4.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-6c44ba32a8

Comment 4 Fedora Update System 2016-08-18 16:54:16 UTC
amavisd-new-2.11.0-4.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-0ff4ff1572

Comment 5 Fedora Update System 2016-08-19 00:23:32 UTC
amavisd-new-2.11.0-4.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-6c44ba32a8

Comment 6 Fedora Update System 2016-08-19 00:59:30 UTC
amavisd-new-2.11.0-4.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-e2ac9d7455

Comment 7 Matt Kinni 2016-08-22 15:11:22 UTC
Hello,

I just upgraded to amavisd-new-2.11.0-4.fc24.noarch via the updates-testing repo and verified that I was able to verify that dkim signing works again for ORIGINATING mail.

This issue is fixed for me - thank you!

Comment 8 Fedora Update System 2016-08-26 10:22:11 UTC
amavisd-new-2.11.0-4.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2016-08-26 12:49:17 UTC
amavisd-new-2.11.0-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2016-08-27 10:23:12 UTC
amavisd-new-2.11.0-4.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.