Gitweb:
https://git.exim.org/exim.git/commitdiff/caf6aa3b459c73c266d5c7caf66620afb733fbbb
Commit: caf6aa3b459c73c266d5c7caf66620afb733fbbb
Parent: 805fd869d551c36d1d77ab2b292a7008d643ca79
Author: Jeremy Harris <jgh146exb@???>
AuthorDate: Thu May 17 11:18:04 2018 +0100
Committer: Jeremy Harris <jgh146exb@???>
CommitDate: Sat May 19 22:12:56 2018 +0100
Docs: add note on DKIM signing-limit security
---
doc/doc-docbook/spec.xfpt | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 4402229..c4b3837 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -39261,6 +39261,12 @@ strict enforcement should code the check explicitly.
The number of signed body bytes. If zero ("0"), the body is unsigned. If no
limit was set by the signer, "9999999999999" is returned. This makes sure
that this variable always expands to an integer value.
+.new
+&*Note:*& The presence of the signature tag specifying a signing body length
+is one possible route to spoofing of valid DKIM signatures.
+A paranoid implementation might wish to regard signature where this variable
+shows less than the "no limit" return as being invalid.
+.wen
.vitem &%$dkim_created%&
UNIX timestamp reflecting the date and time when the signature was created.
