From 6c6b0b161caa31c2ba4ce45e715d0324ebf22e41 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Sat, 6 Nov 2021 10:45:59 +0100 Subject: [PATCH 1/4] Set the right flags on the rate_limit cookie --- core/admin/mailu/sso/views/base.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/admin/mailu/sso/views/base.py b/core/admin/mailu/sso/views/base.py index fbee52a7..c11c588a 100644 --- a/core/admin/mailu/sso/views/base.py +++ b/core/admin/mailu/sso/views/base.py @@ -38,7 +38,7 @@ def login(): flask.session.regenerate() flask_login.login_user(user) response = flask.redirect(destination) - response.set_cookie('rate_limit', utils.limiter.device_cookie(username), max_age=31536000, path=flask.url_for('sso.login')) + response.set_cookie('rate_limit', utils.limiter.device_cookie(username), max_age=31536000, path=flask.url_for('sso.login'), secure=True, httponly=True) flask.current_app.logger.info(f'Login succeeded for {username} from {client_ip}.') return response else: From bbef4bee2763011af11a14568c4d85c54a73557e Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Sun, 7 Nov 2021 12:20:31 +0100 Subject: [PATCH 2/4] Don't return any key for relayed domains We may want to revisit this (ARC signing)... but in the meantime it saves from a scary message in rspamd signing failure: cannot request data from the vault url: /internal/rspamd/vault/v1/dkim/ ... --- core/admin/mailu/internal/views/rspamd.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/core/admin/mailu/internal/views/rspamd.py b/core/admin/mailu/internal/views/rspamd.py index 8551eb8f..123ec4e2 100644 --- a/core/admin/mailu/internal/views/rspamd.py +++ b/core/admin/mailu/internal/views/rspamd.py @@ -14,6 +14,11 @@ def vault_error(*messages, status=404): @internal.route("/rspamd/vault/v1/dkim/", methods=['GET']) def rspamd_dkim_key(domain_name): + models.Relay.query.get(domain_name) and return flask.jsonify({ + 'data': { + 'selectors': [] + } + }) domain = models.Domain.query.get(domain_name) or flask.abort(vault_error('unknown domain')) key = domain.dkim_key or flask.abort(vault_error('no dkim key', status=400)) return flask.jsonify({ From dc6e970a7f668a9030aff44100682b3a17dc6346 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Sun, 7 Nov 2021 12:41:29 +0100 Subject: [PATCH 3/4] handle HTTP too --- core/admin/mailu/sso/views/base.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/admin/mailu/sso/views/base.py b/core/admin/mailu/sso/views/base.py index c11c588a..831949e7 100644 --- a/core/admin/mailu/sso/views/base.py +++ b/core/admin/mailu/sso/views/base.py @@ -38,7 +38,7 @@ def login(): flask.session.regenerate() flask_login.login_user(user) response = flask.redirect(destination) - response.set_cookie('rate_limit', utils.limiter.device_cookie(username), max_age=31536000, path=flask.url_for('sso.login'), secure=True, httponly=True) + response.set_cookie('rate_limit', utils.limiter.device_cookie(username), max_age=31536000, path=flask.url_for('sso.login'), secure=app.config['SESSION_COOKIE_SECURE'], httponly=True) flask.current_app.logger.info(f'Login succeeded for {username} from {client_ip}.') return response else: From 6bf1a178b94bbfe17da0f0073ab4553ada399c01 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Mon, 8 Nov 2021 09:34:02 +0100 Subject: [PATCH 4/4] Go with ghostwheel42's suggestion --- core/admin/mailu/internal/views/rspamd.py | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/core/admin/mailu/internal/views/rspamd.py b/core/admin/mailu/internal/views/rspamd.py index 123ec4e2..458dbb81 100644 --- a/core/admin/mailu/internal/views/rspamd.py +++ b/core/admin/mailu/internal/views/rspamd.py @@ -14,22 +14,14 @@ def vault_error(*messages, status=404): @internal.route("/rspamd/vault/v1/dkim/", methods=['GET']) def rspamd_dkim_key(domain_name): - models.Relay.query.get(domain_name) and return flask.jsonify({ - 'data': { - 'selectors': [] - } - }) - domain = models.Domain.query.get(domain_name) or flask.abort(vault_error('unknown domain')) - key = domain.dkim_key or flask.abort(vault_error('no dkim key', status=400)) - return flask.jsonify({ - 'data': { - 'selectors': [ + selectors = [] + if domain := models.Domain.query.get(domain_name): + if key := domain.dkim_key: + selectors.append( { 'domain' : domain.name, 'key' : key.decode('utf8'), 'selector': flask.current_app.config.get('DKIM_SELECTOR', 'dkim'), } - ] - } - }) - + ) + return flask.jsonify({'data': {'selectors': selectors}})