Rspamd: [BUG] DKIM signature check fails on mixed l= values

[andris9]

Prerequisites

• [x] Put an X between the brackets on this line if you have done all of the following:
  
  
  
  • Read about bug reporting in general: https://rspamd.com/doc/faq.html#how-to-report-bugs-found-in-rspamd
  
  
  • Enabled relevant debugging logs: https://rspamd.com/doc/faq.html#how-to-debug-some-module-in-rspamd
  
  
  • Checked the FAQs about Core files in case of fatal crash: https://rspamd.com/doc/faq.html#how-to-figure-out-why-rspamd-process-crashed
  
  
  • Tried ASAN package and obtained the ASAN report (if possible): https://rspamd.com/doc/faq.html#asan-builds
  
  
  • Checked that your issue isn't already filed: https://github.com/issues?utf8=%E2%9C%93&q=is%3Aissue+user%3Arspamd
  
  
  • Checked that there is not already an experimental package or master branch
  
  

Describe the bug
When an email includes multiple DKIM signatures with the same canonicalisation algorithm but different l= tag values then only the first signature passes and the following ones fail.

Main problem that occurs is that some DMARC checks fail. If the sender has signed the email with a l= tag and intermediate MTA adds another signature using the same canonicalisation but without l= then Rspamd validates the non-aligning signature from the MTA but fails the aligning signature from the sender and thus also fails DMARC.

Steps to Reproduce

1. Scan this message with Rspamd
2. First signature passes, second one fails
3. Sending the same email to Gmail results in both signatures as passed

Expected behavior
Rspamd correctly validates both signatures.

Versions

rspamd --version
Rspamd daemon version 2.6

Additional Information

• RFC6376#page-23 for the definition of the l= tag

[vstakhov]

l tag is brain damaged by design. I was very reluctant to support it as there are almost no good reasons for it to exists.

[andris9]

Yeah, I agree, I was super surprised to see that someone (a large company) actually uses it.

[vstakhov]

It should work now :)

[andris9]

Awesome, we'll try it out!

[andris9]

I built rspamd from sources and can confirm that all my test emails now have a passing DKIM/DMARC. Thank you!