b4: DKIM 'x' causes BADSIGs on otherwise valid emails

b4: DKIM 'x' causes BADSIGs on otherwise valid emails

[Arsen Arsenović]

[-- Attachment #1: Type: text/plain, Size: 1381 bytes --]

Hi all!

DKIM signatures expire, due to the 'x' key; see
https://datatracker.ietf.org/doc/html/rfc6376#page-24

dkimpy implements this check:

    if b'x' in sig:
        if re.match(br"\d+$", sig[b'x']) is None:
            raise ValidationError(
              "x= value is not a decimal integer (%s)" % sig[b'x'])
        x_sign = int(sig[b'x'])
        now = int(time.time())
        slop = 36000 # 10H leeway for mailers with inaccurate clocks
        if x_sign < now - slop:
            raise ValidationError(
                "x= value is past (%s)" % sig[b'x'])
        if t_sign and x_sign < t_sign:
            raise ValidationError(
                "x= value is less than t= value (x=%s t=%s)" %
                (sig[b'x'], sig[b't']))

... thus, it seems to be impossible for 'b4 am' to verify signatures of
patches sent more than ten hours ago.

Of course, this makes sense for a compliant DKIM implementation, but b4
frequently verifies emails long after their delivery, so it can cause
trouble there.

Hacking this check out of dkimpy works.

Reproducer:

  b4 am --allow-unicode-control-chars https://inbox.sourceware.org/gcc-patches/20260709164046.2207585-2-aarsenovic@baylibre.com/

b4 and dkimpy version:

  ~$ qlist -Iv b4 dkim
  dev-python/dkimpy-1.1.8
  net-mail/b4-0.15.2-r1

Have a lovely day!
-- 
Arsen Arsenović

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 300 bytes --]