From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2791CC433F5 for ; Thu, 21 Oct 2021 22:59:17 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id E1AC86128E for ; Thu, 21 Oct 2021 22:59:16 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org E1AC86128E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linuxfoundation.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=CZwtn0EEp1G9cO9w9blxkrSWysHzZ8+y4lKqyzg/DkA=; b=J/Ork/fCoURYie czhZPg5Rwc+E47hMGY/2VfzQ3300WH5cL2GKj9MbWg0Ra8SiXaDRMVYmof21Or4Yzhoo4rMsr8w2T 52AhqcXYRfXBozd2Nam1aHHyKVWlYxGFFvK0CkmEjaUGDtqEuuAtAiwQqD0q5oQWmpcqUqf6RfC9D w6zIYEm9KV563J4BfJRaCHTh1t6QF6gNfEYNNRzGzUBldeJfjZYJSCJ+Wxmlfqs3D4pGHGNw/2C+8 2NbJDXlLsJMpWURQceEwUSVwmNTsi7cs9+gjkPPv85vhHfW9Z/GtKQd3zxDloKFW5M25grjuecaQz wu4Z0waF6wg8+E8j5MpA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mdh0D-009G70-HN; Thu, 21 Oct 2021 22:57:37 +0000 Received: from mail-qk1-x735.google.com ([2607:f8b0:4864:20::735]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mdh0A-009G6S-Cf for linux-arm-kernel@lists.infradead.org; Thu, 21 Oct 2021 22:57:36 +0000 Received: by mail-qk1-x735.google.com with SMTP id 77so3000092qkh.6 for ; Thu, 21 Oct 2021 15:57:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=6zsYSHaX3Rn1myrNn9kPr/4NG6vITikITKqlicR6+ng=; b=WzUalZ/leiYo5KFzgz2TyGz68/0zZaabC2tn+LhqeJbj/jzTY+BBaVPICoxO3WbwPB g5oqczcKB01+dECfd/jcRsUhmDwXEr61NK2K8pTawNw8pw1C/sg0jM1lDe9odT2QzVAQ HbcaogVoOYItv4v7I0G9tvYRqA2I7phAf3Gos= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=6zsYSHaX3Rn1myrNn9kPr/4NG6vITikITKqlicR6+ng=; b=TgGcZY0knShKXY9SUHGwKhZeIDjkLQLRp7ZyhI8Jy7DBN0PrpA+ebVmFS2kVcv33a8 kfJwhghk2tJ2kzbugUhEaVBLhfzCPhQJIlRPLUTYtZSowcEiMaw0qERcDXzHmZkLfVpq dWg67UFqTyzUsoBYPZRt3ekRcVETsSlsFmDKcaAQ51bLgDlEvY9jwjgF4/w+qBjdIxmE kbIgFtxgiuoZP9rW/GRA3vuw+IiiVhFXcSVzsTXKnDDaFKNl347LjBzp0U3CWOHuX/pg tM+Od7hnbmMsdgARP5eXznLFhluB0Si0Dme+TMwkHQjifRFQDrxx+MSbSIHwwI+wK0pA o+3w== X-Gm-Message-State: AOAM532BIjU2c4E0Y80KRUiWo8ksBx5wCk2I3S2dWDiGaTLiSB+xrx6R 6ssrDTelPYfUy9nkVWT4ihhAFA== X-Google-Smtp-Source: ABdhPJzVk1IjPgtzWZyvGG/HfrPb/pw4VCYEB/09eugJLKpy0M2iwaYGQY/9EXMfQqycKpUmptHEBQ== X-Received: by 2002:a37:9404:: with SMTP id w4mr6843769qkd.469.1634857053106; Thu, 21 Oct 2021 15:57:33 -0700 (PDT) Received: from meerkat.local (bras-base-mtrlpq5031w-grc-32-216-209-220-181.dsl.bell.ca. [216.209.220.181]) by smtp.gmail.com with ESMTPSA id bm25sm3530266qkb.4.2021.10.21.15.57.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 21 Oct 2021 15:57:32 -0700 (PDT) Date: Thu, 21 Oct 2021 18:57:31 -0400 From: Konstantin Ryabitsev To: David Woodhouse Cc: Kees Cook , tools@linux.kernel.org, linux-arm-kernel@lists.infradead.org Subject: Re: injected body trailers Message-ID: <20211021225731.qril46obyaywoqhw@meerkat.local> References: <202110211313.B5C5C61@keescook> <20211021204459.xd63t5xn24vktqf3@meerkat.local> <7786271477279d4fbf9292db1f6aede8428eb00d.camel@infradead.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <7786271477279d4fbf9292db1f6aede8428eb00d.camel@infradead.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211021_155734_461211_CAE600F1 X-CRM114-Status: GOOD ( 24.57 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Thu, Oct 21, 2021 at 10:42:46PM +0100, David Woodhouse wrote: > > > (I realize now that all the mail from linux-arm-kernel has been > > > getting dropped into my Spam folder -- I normally don't notice since > > > I'm usually CCed directly or via some other list on things I wanted > > > to see.) > > > > > > 3) Are there other lists for which lore is collecting emails where DKIM > > > is persistently broken, and can we fix those lists too? > > > > I would also note that lists.infradead.org should not really be adding its own > > DKIM signature to messages it sends out. It doesn't really serve any purpose > > unless the From: header is rewritten (but please don't do that either). > > No, it matches the Sender: header, which is the entity that actually > submitted the mail to the system (as opposed to the possibly multiple > entities listed in the From: header, which are merely authors of the > message). I know that's how it was envisioned to work (it's in the DKIM RFC as recommendation for mailing list operators), but this didn't make it into the DMARC standard -- DMARC intentionally ignores the Sender: header and will *always* look at the From: header when performing DKIM validation. (https://datatracker.ietf.org/doc/html/rfc7489#appendix-A.3) It was a bad idea in the first place, if you think about it. I can take any message, add a Sender: header for the domain that I control and force the validating system to check the DKIM-Signature header that I injected instead of the signature from the originating domain, thus making any message I touch pass DMARC verification. So, I have to double-down on my statement that adding a lists.infradead.org DKIM signature doesn't actually serve any purpose, at least not when it comes to appeasing DMARC filters. -K _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel