Repository navigation
Support sendmail headers #11
Description
Here come headers inserted by sendmail. I show the two uppermost received headers, only the second one is relative:
Received: from mail.aegee.org ([unix socket]) by mail.aegee.org (Cyrus 3.4.4) with LMTPA; Sun, 18 Dec 2022 07:03:24 +0000
Received: from 69-171-232-143.mail-mail.facebook.com (69-171-232-143.mail-mail.facebook.com [69.171.232.143]) by mail.aegee.org (8.17.1/8.17.1) with ESMTPS id 2BI73F8b1489360 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO) for <my@address>; Sun, 18 Dec 2022 07:03:16 GMT
verify=NO means that the sending server has not volunarily presented a certificate. Another example with verify=OK
Received: from mail.aegee.org ([unix socket]) by mail.aegee.org (Cyrus 3.4.4) with LMTPA; Fri, 16 Dec 2022 22:41:09 +0000
Received: from smtp.github.com (out-18.smtp.github.com [192.30.252.201]) by mail.aegee.org (8.17.1/8.17.1) with ESMTPS id 2BGMf4uY685293 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for <my@address>; Fri, 16 Dec 2022 22:41:05 GMT
Please add parsing for sendmail-generated Received: headers and possibly add an option whether only postfix or only sendmail generated headers shall be handled (if this option would make things faster).
Originally posted by @dilyanpalauzov in #4 (comment)
Activity
GermanCoding commentedon Dec 23, 2022
@dilyanpalauzov I don't have a sendmail at hand to test, but I'm looking into it.
We also use a regex to detect mails originating from the local machine. Does Sendmail also log this in a special way (Postfix shows "from userid " in the Received header)?
Also: Does this require a special configuration with sendmail, or are these Received-headers the defaults?
Preliminary support for Sendmail (fixes #11)
dilyanpalauzov commentedon Dec 23, 2022
What is the purpose of special handling emails originating from the local machine? When.the email is submitted (with the SUBMIT protocol), I have the header:
Authentication-Results: mail.aegee.org/2BNJga6J661958; auth=pass (PLAIN) smtp.auth=zzz@aegee.org
This is a standard header, so it does not matter of I made some custom configuration to get it inserted. Nevertheless for locally submitted emails by calling sendmail on the command line there are no extra additions in the headers. There could be such additions, if the submittimg iser is not “trusted”, but in my case users are “trusted” and there is no extra header with the warning.
These are the default Received headera.
GermanCoding commentedon Dec 23, 2022
The idea is to avoid falsely flagging mails as insecure when their contents have never left the machine (local mailboxes), since local communication likely doesn't use TLS. Commands like
mail(x)or similar. This is of course not applicable to all mailservers (some will only ever receive mails over a network connection), but it's always nice if we can handle such setups as well. These mails then get a blue logo along with the message "mail was internal". This plugin doesn't currently consider authentication.If this is not easily detectable with sendmail we're probably going to just ignore it and go with a simple TLS vs no-TLS decision.
Is it possible to turn off the TLS logging in Sendmail, i.e. do we need to document that certain default option needs to be kept enabled, or is this always-on?
dilyanpalauzov commentedon Dec 27, 2022
I see that moving the mouse pointer over the lock shows the connection details. Please consider rewriting
verify=from the tooltip to the values from #12 (comment).GermanCoding commentedon Dec 27, 2022
I had thought about this, but I don't really know of a good way to handle this in general. As is, the tooltip is basically expert information that is of limited to no value for average users. Both the Sendmail and Postfix syntax write stuff like "256/256 bit", "verify=something", which could warrant an explanation. Ciphers and TLS versions aren't exactly general knowledge either.
However, if we wanted to explain this, we need longer texts. We definetly don't want to have these in the tooltip: It gets way to long, we can't format it, and it gets annoying for expert users. A linkage to an (external) site that explains the strings (in general) would be fine, but I don't think you can put links into tooltips. I haven't seen a good way to handle this, so the status quo is that users need to figure this out themselves, if they really care. Most will just ignore the information they don't understand.
If you or anyone else has an idea how this could be handled, I'm open to suggestions. Perhaps a JavaScript-controlled popup with full styling or something in that direction?
dilyanpalauzov commentedon Feb 23, 2023
Would you mind releasing a new version with the sendmail changes? When upgrading Roundcube I have currently to manually apply a patch for this.