trusteddomainproject / opendkim Goto Github PK

diff --git a/opendkim/opendkim.c b/opendkim/opendkim.c
--- a/opendkim/opendkim.c
+++ b/opendkim/opendkim.c
@@ -4724,10 +4724,9 @@ dkimf_securefile(const char *path, ino_t *ino, uid_t myuid, char *err,
        if (myuid == (uid_t) -1)
                myuid = pw->pw_uid;
 
-       pthread_mutex_unlock(&pwdb_lock);
-
 #ifdef HAVE_REALPATH
        strlcpy(myname, pw->pw_name, sizeof myname);
+       pthread_mutex_unlock(&pwdb_lock);
 
        p = realpath(path, real);
        if (p == NULL)
@@ -4766,6 +4765,7 @@ dkimf_securefile(const char *path, ino_t *ino, uid_t myuid, char *err,
 
        return 1;
 #else /* HAVE_REALPATH */
+       pthread_mutex_unlock(&pwdb_lock);
        struct stat s;
 
        status = stat(path, &s);

diff --git a/RELEASE_NOTES b/RELEASE_NOTES
--- a/RELEASE_NOTES
+++ b/RELEASE_NOTES
@@ -6,7 +6,7 @@ release, and a summary of the changes in that release.
 2.11.0         2018/05/31
        README: Clarify for the send+verify mode how to tweak sendmail not
                to break signatures.
-       Add support for ED25519 keys.
+       Add support for ED25519 keys with OpenSSL.
        Add "header.s" and "header.a" in generated Authentication-Results
                header fields.
        Add _FFR_CONDITIONAL, experimental support for conditional DKIM
diff --git a/libopendkim/dkim.c b/libopendkim/dkim.c
--- a/libopendkim/dkim.c
+++ b/libopendkim/dkim.c
@@ -1172,7 +1172,7 @@ dkim_privkey_load(DKIM *dkim)
 #endif /* USE_GNUTLS */
 
 #ifdef USE_GNUTLS 
-       status = gnutls_x509_privkey_init(&crypto->rsa_key);
+       status = gnutls_x509_privkey_init(&crypto->crypto_key);
        if (status != GNUTLS_E_SUCCESS)
        {
                dkim_load_ssl_errors(dkim, status);
@@ -1182,14 +1182,14 @@ dkim_privkey_load(DKIM *dkim)
 
        if (strncmp((char *) dkim->dkim_key, "-----", 5) == 0)
        {                                               /* PEM */
-               status = gnutls_x509_privkey_import(crypto->rsa_key,
-                                                   &crypto->rsa_keydata,
+               status = gnutls_x509_privkey_import(crypto->crypto_key,
+                                                   &crypto->crypto_keydata,
                                                    GNUTLS_X509_FMT_PEM);
        }
        else
        {
-               status = gnutls_x509_privkey_import(crypto->rsa_key,
-                                                   &crypto->rsa_keydata,
+               status = gnutls_x509_privkey_import(crypto->crypto_key,
+                                                   &crypto->crypto_keydata,
                                                    GNUTLS_X509_FMT_DER);
        }
 
@@ -1200,7 +1200,7 @@ dkim_privkey_load(DKIM *dkim)
                return DKIM_STAT_NORESOURCE;
        }
 
-       status = gnutls_privkey_init(&crypto->rsa_privkey);
+       status = gnutls_privkey_init(&crypto->crypto_privkey);
        if (status != GNUTLS_E_SUCCESS)
        {
                dkim_load_ssl_errors(dkim, status);
@@ -1208,18 +1208,18 @@ dkim_privkey_load(DKIM *dkim)
                return DKIM_STAT_NORESOURCE;
        }
 
-       status = gnutls_privkey_import_x509(crypto->rsa_privkey,
-                                           crypto->rsa_key, 0);
+       status = gnutls_privkey_import_x509(crypto->crypto_privkey,
+                                           crypto->crypto_key, 0);
        if (status != GNUTLS_E_SUCCESS)
        {
                dkim_load_ssl_errors(dkim, status);
                dkim_error(dkim, "gnutls_privkey_import_x509() failed");
-               (void) gnutls_privkey_deinit(rsa->rsa_privkey);
+               (void) gnutls_privkey_deinit(crypto->crypto_privkey);
                return DKIM_STAT_NORESOURCE;
        }
 
-       (void) gnutls_privkey_get_pk_algorithm(rsa->rsa_privkey,
-                                              &rsa->rsa_keysize);
+       (void) gnutls_privkey_get_pk_algorithm(crypto->crypto_privkey,
+                                              &crypto->crypto_keysize);
 
 #else /* USE_GNUTLS */
 
@@ -5533,6 +5533,11 @@ dkim_sig_process(DKIM *dkim, DKIM_SIGINFO *sig)
        size_t diglen = 0;
 #ifdef USE_GNUTLS
        gnutls_datum_t key;
+#if GNUTLS_VERSION_MAJOR==3
+       gnutls_digest_algorithm_t hash;
+       gnutls_sign_algorithm_t sign_algo;
+#endif
+
 #else /* USE_GNUTLS */
        BIO *key;
 #endif /* USE_GNUTLS */
@@ -5685,11 +5690,26 @@ dkim_sig_process(DKIM *dkim, DKIM_SIGINFO *sig)
                        return DKIM_STAT_OK;
                }
 
+#if GNUTLS_VERSION_MAJOR==2
                vstat = gnutls_pubkey_verify_hash(crypto->crypto_pubkey, 0,
+#else
+               hash = dkim_libfeature(dkim->dkim_libhandle, DKIM_FEATURE_SHA256) &&
+                       sig->sig_hashtype == DKIM_HASHTYPE_SHA256 ? GNUTLS_DIG_SHA256 : GNUTLS_DIG_SHA1;
+
+               sign_algo = gnutls_pk_to_sign(GNUTLS_PK_RSA, hash);
+               if (sign_algo == GNUTLS_SIGN_UNKNOWN)
+               {
+                       assert(0);
+                       /* NOTREACHED */
+               }
+
+               vstat = gnutls_pubkey_verify_hash2(crypto->crypto_pubkey,
+                                                   sign_algo, 0,
+#endif
                                                  &crypto->crypto_digest,
                                                  &crypto->crypto_sig);
                if (vstat < 0)
-                       dkim_sig_load_ssl_errors(dkim, sig, rsastat);
+                       dkim_sig_load_ssl_errors(dkim, sig, vstat);
 
                (void) gnutls_pubkey_get_pk_algorithm(crypto->crypto_pubkey,
                                                      &crypto->crypto_keysize);

diff --git a/libopendkim/dkim.c b/libopendkim/dkim.c
--- a/libopendkim/dkim.c
+++ b/libopendkim/dkim.c
@@ -5693,8 +5693,6 @@ dkim_sig_process(DKIM *dkim, DKIM_SIGINFO *sig)
                vstat = gnutls_pubkey_verify_hash(crypto->crypto_pubkey, 0,
                                                  &crypto->crypto_digest,
                                                  &crypto->crypto_sig);
-               if (vstat < 0)
-                       dkim_sig_load_ssl_errors(dkim, sig, vstat);
 # else /* GNUTLS_VERSION_MAJOR == 2 */
                hash = dkim_libfeature(dkim->dkim_libhandle,
                                       DKIM_FEATURE_SHA256);
@@ -5709,9 +5707,12 @@ dkim_sig_process(DKIM *dkim, DKIM_SIGINFO *sig)
                                                   signalg, 0,
                                                   &crypto->crypto_digest,
                                                   &crypto->crypto_sig);
+# endif /* GNUTLS_VERSION_MAJOR == 2 */
                if (vstat < 0)
                        dkim_sig_load_ssl_errors(dkim, sig, vstat);
-# endif /* GNUTLS_VERSION_MAJOR == 2 */
+               else
+                       /* OpenSSL’s RSA_verify returns 1 on success, so we normalize vstat here */
+                       vstat = 1;
 
                (void) gnutls_pubkey_get_pk_algorithm(crypto->crypto_pubkey,
                                                      &crypto->crypto_keysize);

diff --git a/opendkim/opendkim-db.c b/opendkim/opendkim-db.c
--- a/opendkim/opendkim-db.c
+++ b/opendkim/opendkim-db.c
@@ -20,7 +20,6 @@
 #ifdef HAVE_STDBOOL_H
 # include <stdbool.h>
 #endif /* HAVE_STDBOOL_H */
-#include <syslog.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
diff --git a/opendkim/opendkim-lua.c b/opendkim/opendkim-lua.c
--- a/opendkim/opendkim-lua.c
+++ b/opendkim/opendkim-lua.c
@@ -600,7 +600,7 @@ dkimf_lua_setup_hook(void *ctx, const char *script, size_t scriptlen,
 **     -1 -- memory allocation failure
 **
 **  Notes:
-**     Called by mlfi_eom() so it can decide whether or not the message
+**     Called by mlfi_eoh() so it can decide whether or not the message
 **     is acceptable.
 */
 
diff --git a/opendkim/opendkim.c b/opendkim/opendkim.c
--- a/opendkim/opendkim.c
+++ b/opendkim/opendkim.c
@@ -750,7 +750,6 @@ _Bool querycache;                           /* local query cache */
 #endif /* QUERY_CACHE */
 _Bool die;                                     /* global "die" flag */
 int diesig;                                    /* signal to distribute */
-int thread_count;                              /* thread count */
 #ifdef QUERY_CACHE
 time_t cache_lastlog;                          /* last cache stats logged */
 #endif /* QUERY_CACHE */
@@ -5233,7 +5232,7 @@ dkimf_msr_body(struct signreq *sr, DKIM **last, u_char *body, size_t bodylen)
 
 /*
 **  DKIMF_MSR_MINBODY -- determine minimum body required to satisfy all
-**                       all open canonicalizations
+**                       open canonicalizations
 **
 **  Parameters:
 **     srh -- head of the signature request list
@@ -11213,7 +11212,6 @@ mlfi_envrcpt(SMFICTX *ctx, char **envrcpt)
                                       "message requeueing (internal error)");
                        }
 
-                       free(copy);
                        dkimf_cleanup(ctx);
                        return SMFIS_TEMPFAIL;
                }
@@ -16595,11 +16593,11 @@ main(int argc, char **argv)
        {
                if (curconf->conf_dolog)
                {
-                       syslog(LOG_ERR, "pthread_sigprocmask(): %s",
+                       syslog(LOG_ERR, "pthread_sigmask(): %s",
                               strerror(status));
                }
 
-               fprintf(stderr, "%s: pthread_sigprocmask(): %s\n", progname,
+               fprintf(stderr, "%s: pthread_sigmask(): %s\n", progname,
                        strerror(status));
 
                dkimf_zapkey(curconf);

diff --git a/opendkim/stats.c b/opendkim/stats.c
--- a/opendkim/stats.c
+++ b/opendkim/stats.c
@@ -56,11 +56,6 @@
 #include "opendkim.h"
 #include "opendkim-db.h"
 
-/* macros, defaults */
-#define        DEFCT                   "text/plain"
-#define        DEFCTE                  "7bit"
-#define        DKIMF_STATS_MAXCOST     10
-
 /* globals */
 static pthread_mutex_t stats_lock;
 

diff --git a/opendkim/opendkim.c b/opendkim/opendkim.c
index 6938e21b..ab56ac22 100644
--- a/opendkim/opendkim.c
+++ b/opendkim/opendkim.c
@@ -12299,7 +12299,7 @@ mlfi_eoh(SMFICTX *ctx)
        */
 
        /* signing requests with signing mode disabled */
-       if (dfc->mctx_srhead != NULL && 
+       if (!testmode && dfc->mctx_srhead != NULL &&
            (conf->conf_mode & DKIMF_MODE_SIGNER) == 0)
                return SMFIS_ACCEPT;

diff --git a/opendkim/opendkim-dns.c b/opendkim/opendkim-dns.c
--- a/opendkim/opendkim-dns.c
+++ b/opendkim/opendkim-dns.c
@@ -75,6 +75,7 @@ struct dkimf_unbound
        pthread_cond_t          ub_ready;
 };
 
+pthread_mutex_t                ub_config_mutex;
 /* struct dkimf_unbound_cb_data -- libunbound callback data */
 struct dkimf_unbound_cb_data
 {
@@ -440,7 +441,9 @@ dkimf_ub_config(void *srv, const char *file)
 
        ub = srv;
 
+       pthread_mutex_lock(&ub_config_mutex);
        status = ub_ctx_config(ub->ub_ub, (char *) file);
+       pthread_mutex_unlock(&ub_config_mutex);
 
        return (status == 0 ? 0 : -1);
 }
diff --git a/opendkim/opendkim-dns.h b/opendkim/opendkim-dns.h
--- a/opendkim/opendkim-dns.h
+++ b/opendkim/opendkim-dns.h
@@ -33,6 +33,7 @@ struct dkimf_filedns;
 /* libunbound includes */
 # include <unbound.h>
 
+extern pthread_mutex_t         ub_config_mutex;
 /* prototypes */
 extern int dkimf_unbound_setup __P((DKIM_LIB *));
 # ifdef _FFR_RBL
diff --git a/opendkim/opendkim.c b/opendkim/opendkim.c
--- a/opendkim/opendkim.c
+++ b/opendkim/opendkim.c
@@ -15555,6 +15555,9 @@ main(int argc, char **argv)
        no_i_whine = TRUE;
        conffile = NULL;
 
+#ifdef USE_UNBOUND
+       pthread_mutex_init(&ub_config_mutex, NULL);
+#endif
        memset(myhostname, '\0', sizeof myhostname);
        (void) gethostname(myhostname, sizeof myhostname);
 

diff --git a/RELEASE_NOTES b/RELEASE_NOTES
--- a/RELEASE_NOTES
+++ b/RELEASE_NOTES
@@ -4,6 +4,8 @@ This listing shows the versions of the OpenDKIM package, the date of
 release, and a summary of the changes in that release.
 
 2.11.0         2018/05/31
+       opendkim/README: Clarify for the send+verify mode how to tweak
+               sendmail not to break signatures.
        Add support for ED25519 keys.
        Add "header.s" and "header.a" in generated Authentication-Results
                header fields.
diff --git a/opendkim/README b/opendkim/README
--- a/opendkim/README
+++ b/opendkim/README
@@ -160,7 +160,38 @@ start at step (5).
         socket specification:
            INPUT_MAIL_FILTER(`opendkim', `S=inet:8891@localhost')
 
-    (c) Rebuild your sendmail.cf in the usual way
+    (c) When the MTA will be used for relaying emails, e.g. delivering to other
+        hosts using the aliases mechanism, it is important not to break
+        signatures inserted by the original sender, in particular when the
+        sending domain published p=reject; DMARC policy.  By default, sendmail
+        adds quotes to address headers, when there are no quotes and the
+        display-part of the address contains fullstop or apostrophe,
+        invalidating any DKIM signatures contained in the message.  To tell
+        sendmail not to modify the headers insert in sendmail.mc:
+           conf(`confMUST_QUOTE_CHARS', `')
+
+    (d) As stated in sendmail's KNOWNBUGS file, sendmail truncates
+        header-values longer than 256 characters, which could mean truncating
+        the domain of a long From:-header-value and invaldating the signature.
+        Consider increasing MAXNAME in sendmail/conf.h to mitigate changing
+        the messages and invalidating their signatures.  This change requires
+        recompiling sendmail.
+
+    (e) Beware that when sendmail receives the header:
+
+To: Aaaaaaaaaaaaaaaaaa aaaaaaaaaaa aaaaaaaaaaaa <[email protected]>,Bbbbbbbbbbbbbbbbbb b <[email protected]>
+Message-ID: <[email protected]>
+
+        it will send it unmodified to the milter and later rewrite it to:
+
+To: Aaaaaaaaaaaaaaaaaa aaaaaaaaaaa aaaaaaaaaaaa <[email protected]>,
+        Bbbbbbbbbbbbbbbbbb b <[email protected]>
+
+        After the comma a new line and eight spaces were inserted.  The
+       insertion of white space characters (during folding) breaks the DKIM
+       signature.
+
+    (f) Rebuild your sendmail.cf in the usual way
 
     For Postfix:
 
@@ -272,6 +303,17 @@ your sendmail.mc file:
 
        define(`confSEVEN_BIT_INPUT',true)dnl
 
+However, the aforementioned tweak changes the byte sequence C2 A0 (NO BREAK
+SPACE) into "B ", altering what is displayed to the final user. In practice,
+when the server running OpenDKIM is used just for relaying email in terms of
+aliases, having mailboxes hosted somewhere else, relayed messages are
+displayed correctly to the final user only when the tweak is not made.
+
+The further, when openDKIM is used both to sign and verify signatures, a set
+confSEVER_BIT_INPUT invalidates the signature added by the original sender.
+If the MTA connected to OpenDKIM is used to relay messages, e.g. as aliases,
+and the origianl sender set p=reject; DMARC policy, then the adjustment is
+counterproductive.
 
 TESTING
 =======

diff --git a/libopendkim/dkim.c b/libopendkim/dkim.c
--- a/libopendkim/dkim.c
+++ b/libopendkim/dkim.c
@@ -2103,7 +2103,7 @@ dkim_siglist_setup(DKIM *dkim)
                }
                else
                {
-                       signalg = dkim_name_to_code(algorithms,
+                       dkim->dkim_siglist[c]->sig_signalg = signalg = dkim_name_to_code(algorithms,
                                                    (char *) param);
 
                        if (signalg == -1)
@@ -2147,7 +2147,6 @@ dkim_siglist_setup(DKIM *dkim)
                                /* NOTREACHED */
                        }
 
-                       dkim->dkim_siglist[c]->sig_signalg = signalg;
                        dkim->dkim_siglist[c]->sig_hashtype = hashtype;
                }
 

diff --git a/opendkim/opendkim.c b/opendkim/opendkim.c
index 0c5132aa..db24b925 100644
--- a/opendkim/opendkim.c
+++ b/opendkim/opendkim.c
@@ -12741,63 +12741,62 @@ mlfi_eoh(SMFICTX *ctx)
        /* if requested, verify RFC5322-required headers (RFC5322 3.6) */
        if (conf->conf_reqhdrs)
        {
-               _Bool ok = TRUE;
+               char *msg = NULL;
 
                /* exactly one From: */
                if (dkimf_findheader(dfc, "From", 0) == NULL ||
                    dkimf_findheader(dfc, "From", 1) != NULL)
-                       ok = FALSE;
+                       msg = "Message does not have exactly one From header";
 
                /* exactly one Date: */
                if (dkimf_findheader(dfc, "Date", 0) == NULL ||
                    dkimf_findheader(dfc, "Date", 1) != NULL)
-                       ok = FALSE;
+                       msg = "Message does not have exactly one Date header";
 
                /* no more than one Reply-To: */
                if (dkimf_findheader(dfc, "Reply-To", 1) != NULL)
-                       ok = FALSE;
+                       msg = "Message has more than one Reply-To headers";
 
                /* no more than one To: */
                if (dkimf_findheader(dfc, "To", 1) != NULL)
-                       ok = FALSE;
+                       msg = "Message has more than one To headers";
 
                /* no more than one Cc: */
                if (dkimf_findheader(dfc, "Cc", 1) != NULL)
-                       ok = FALSE;
+                       msg = "Message has more than one Cc headers";
 
                /* no more than one Bcc: */
                if (dkimf_findheader(dfc, "Bcc", 1) != NULL)
-                       ok = FALSE;
+                       msg = "Message has more than one Bcc headers";
 
                /* no more than one Message-Id: */
                if (dkimf_findheader(dfc, "Message-Id", 1) != NULL)
-                       ok = FALSE;
+                       msg = "Message has more than one Message-Id headers";
 
                /* no more than one In-Reply-To: */
                if (dkimf_findheader(dfc, "In-Reply-To", 1) != NULL)
-                       ok = FALSE;
+                       msg = "Message has more than one In-Reply-To headers";
 
                /* no more than one References: */
                if (dkimf_findheader(dfc, "References", 1) != NULL)
-                       ok = FALSE;
+                       msg = "Message has more than one References headers";
 
                /* no more than one Subject: */
                if (dkimf_findheader(dfc, "Subject", 1) != NULL)
-                       ok = FALSE;
+                       msg = "Message has more than one Subject headers";
 
-               if (!ok)
+               if (msg)
                {
                        if (conf->conf_dolog)
                        {
                                syslog(LOG_INFO,
-                                      "%s: RFC5322 header requirement error",
-                                      dfc->mctx_jobid);
+                                      "%s: RFC5322 header requirement error %s",
+                                      dfc->mctx_jobid, msg);
                        }
-
-                       dfc->mctx_addheader = TRUE;
-                       dfc->mctx_headeronly = TRUE;
-                       dfc->mctx_status = DKIMF_STATUS_BADFORMAT;
-                       return SMFIS_CONTINUE;
+                       if (dkimf_setreply(ctx, "550", "5.7.1", msg) != MI_SUCCESS &&
+                           conf->conf_dolog)
+                               syslog(LOG_NOTICE, "%s: smfi_setreply() failed", dfc->mctx_jobid);
+                       return SMFIS_REJECT;
                }
        }
 

diff --git a/contrib/repute/repute.py b/contrib/repute/repute.py
--- a/contrib/repute/repute.py
+++ b/contrib/repute/repute.py
@@ -47,13 +47,13 @@ class DKIM(object):
                 "identity": "dkim",
             }
 
-            if res1[0] and len(res1[1]) > 0:
+            if res1[0] and res1[1]:
                 res1 = res1[1][0]
                 reputons["rating"] = res1[0]
                 reputons["sample-size"] = res1[2]
                 reputons["generated"] = res1[1]
 
-            if res2[0] and len(res2[1]) > 0:
+            if res2[0] and res2[1]:
                 res2 = res2[1][0]
                 reputons['rate'] = res2[0]
 
@@ -79,7 +79,7 @@ class DKIM(object):
             
             rows = yield self.cp.runQuery(query, {'domain': domain, 'reporter': reporter})
 
-            if len(rows) > 0:
+            if rows:
                 ret = dict(itertools.izip(fields, rows[0]))
             else:
                 ret = 0
@@ -103,7 +103,7 @@ class DKIM(object):
             fields = ['domain'] +  fields
 
             rows = yield self.cp.runQuery(query, { 'reporter' : reporter } )
-            if len(rows) > 0:
+            if rows:
                 ret = dict(itertools.izip(fields, rows[0]))
                 request.setHeader('Last-modified', rows[0][3].strftime("%A, %d, %B %Y %H:%M GMT"))
             else:

diff --git a/opendkim/opendkim.c b/opendkim/opendkim.c
--- a/opendkim/opendkim.c
+++ b/opendkim/opendkim.c
@@ -5905,7 +5905,6 @@ static void
 dkimf_config_free(struct dkimf_config *conf)
 {
        assert(conf != NULL);
-       assert(conf->conf_refcnt == 0);
 
        dkimf_zapkey(conf);
 

diff --git a/INSTALL b/INSTALL
--- a/INSTALL
+++ b/INSTALL
@@ -158,9 +158,6 @@ filter              Compile the opendkim filter.  Requires libmilter (see
 live-testing   Enables unit tests that require live access to the Internet
                to succeed.
 
-poll           Compile to use poll() instead of select() for asynchronous
-               I/O.
-
 popauth                Enables support for POP-before-SMTP checks.
 
 query_cache    Compile the opendkim library to support local caching of
diff --git a/autobuild/autobuild.conf.sample b/autobuild/autobuild.conf.sample
--- a/autobuild/autobuild.conf.sample
+++ b/autobuild/autobuild.conf.sample
@@ -17,7 +17,6 @@
                "--enable-diffheaders",
                "--enable-vbr",
                "--enable-atps",
-               "--enable-poll",
                "--with-unbound",
                "--enable-replace_rules",
                "--with-libmemcached",
diff --git a/configure.ac b/configure.ac
--- a/configure.ac
+++ b/configure.ac
@@ -353,8 +353,6 @@ AC_DEFUN([LIB_FFR_FEATURE],
 #
 FEATURE([popauth], [enable POP-before-SMTP support])
 
-FEATURE([poll], [use poll() instead of select()])
-
 FFR_FEATURE([atps], [experimental Authorized Third Party Signers checks])
 LIB_FFR_FEATURE([atps], [experimental Authorized Third Party Signers checks])
 AM_CONDITIONAL([ATPS], [test x"$enable_atps" = x"yes"])
diff --git a/opendkim/util.c b/opendkim/util.c
--- a/opendkim/util.c
+++ b/opendkim/util.c
@@ -80,10 +80,6 @@ static char *optlist[] =
        "DEBUG",
 #endif /* DEBUG */
 
-#if POLL
-       "POLL",
-#endif /* POLL */
-
 #if POPAUTH
        "POPAUTH",
 #endif /* POPAUTH */
(END)

diff --git a/opendkim/opendkim.conf.5.in b/opendkim/opendkim.conf.5.in
index 9046a1cd..127c5e69 100644
--- a/opendkim/opendkim.conf.5.in
+++ b/opendkim/opendkim.conf.5.in
@@ -233,7 +233,6 @@ is defined.
 .I DomainKeysCompat (boolean)
 If set, backward compatibility with DomainKeys (RFC4870) key records is
 enabled.  When not set, such keys are considered to be syntactically invalid.
-The default is "false".
 
 .TP
 .I DontSignMailTo (dataset)
@@ -507,7 +506,7 @@ for all addresses.
 .TP
 .I MilterDebug (integer)
 Sets the debug level to be requested from the milter library.  The
-default is 0.
+highest useful value is six.
 
 .TP
 .I Minimum (string)
@@ -533,8 +532,7 @@ valid.
 .I MinimumKeyBits (integer)
 Establishes a minimum key size for acceptable signatures.  Signatures with
 smaller key sizes, even if they otherwise pass DKIM validation, will me marked
-as invalid.  The default is 1024, which accepts all signatures.  A value of
-0 causes the default to be used.
+as invalid.  The default is 1024.  A value of 0 accepts all signatures.
 
 .TP
 .I Mode (string)
.I Mode (string)
@@ -789,7 +787,7 @@ setting.  By default, all header fields are included.
 Specifies a file containing a list of text replacement rules that are
 applied to the message header fields to replace certain content expected to be
 changed as the message passes through local MTAs.  This can be used to
-accommodate expected changes such as are made to From: fields by MTA
+accommodate expected changes such as those made to From: fields by MTA
 "masquerade" features.  Each entry in the file consists of a POSIX regular
 expression, followed by a tab (ASCII 9), followed by the text that should
 be used to replace the text matching the expression.  The '#' character
@@ -836,7 +834,6 @@ Where
 .I ResignMailTo
 triggers a re-signing action, this flag indicates whether or not all mail
 should be signed (if set) versus only verified mail being signed (if not set).
-The default is "false".
 @RESIGN_MANNOTICE@
 
 .TP
@@ -871,7 +868,7 @@ Gives the name of a Lua script that should be run after all of the header
 fields have been processed for a message; in particular, this is useful
 after all DKIM signatures have been detected and initial evaluation has
 been done.  The script has access to all of the header fields and connection
-information and can that certain signatures be ignored based on that
+information and can determine that certain signatures be ignored based on that
 information.  See
 .I opendkim-lua(3)
 for details. @LUA_MANNOTICE@
@@ -1080,6 +1077,10 @@ data from a single repoter.
 If set, instructs the DKIM library to refuse processing of a message if the
 header field count does not conform to RFC5322 Section 3.6.
 
+.TP
+.I StatisticsPolicyScript (string)
+The statistics script is run after all of the DKIM verification and signing work has been completed but before any final message handling is done. The main purpose of this script is to give the user an opportunity to examine the message or its signatures and make arbitrary additional statistical observations that should be recorded by the statistics module.
+
 .TP
 .I StrictTestMode (Boolean)
 Selects strict CRLF mode during testing (see the
@@ -1121,7 +1122,7 @@ messages.
 .I TemporaryDirectory (string)
 Specifies the directory in which temporary canonicalization files should
 be written.  The default is to use the
-.I libdkim
+.I libopendkim
 default location, currently
 .I /tmp.
 

diff --git a/librbl/rbl.c b/librbl/rbl.c
--- a/librbl/rbl.c
+++ b/librbl/rbl.c
@@ -965,8 +965,13 @@ rbl_query_start(RBL *rbl, u_char *query, void **qh)
 
        if (rbl->rbl_dns_service == NULL &&
            rbl->rbl_dns_init != NULL &&
-           rbl->rbl_dns_init(&rbl->rbl_dns_service) != 0)
+           rbl->rbl_dns_init(&rbl->rbl_dns_service) != 0) {
+               if (rbl->rbl_free)
+                       rbl->rbl_free(rbl->rbl_closure, rq);
+               else
+                       free(rq);
                return RBL_STAT_DNSERROR;
+       }
 
        status = rbl->rbl_dns_start(rbl->rbl_dns_service, T_A, rblquery,
                                    rq->rq_buf, sizeof rq->rq_buf, &rq->rq_qh);
diff --git a/opendkim/opendkim.c b/opendkim/opendkim.c
--- a/opendkim/opendkim.c
+++ b/opendkim/opendkim.c
@@ -11404,6 +11404,8 @@ mlfi_header(SMFICTX *ctx, char *headerf, char *headerv)
                        if (conf->conf_dolog)
                                syslog(LOG_ERR, "dkimf_db_get() failed");
 
+                       TRYFREE(newhdr->hdr_hdr);
+                       free(newhdr);
                        return SMFIS_TEMPFAIL;
                }
  
diff --git a/opendkim/util.c b/opendkim/util.c
--- a/opendkim/util.c
+++ b/opendkim/util.c
@@ -812,8 +812,10 @@ dkimf_load_replist(FILE *in, struct replace **list)
                }
 
                p = strrchr(rule, '\t');
-               if (p == NULL)
+               if (p == NULL) {
+                       free(newrep);
                        return FALSE;
+               }
 
                *p = '\0';
 
@@ -821,6 +823,7 @@ dkimf_load_replist(FILE *in, struct replace **list)
                if (status != 0)
                {
                        fprintf(stderr, "%s: regcomp() failed\n", progname);
+                       free(newrep);
                        return FALSE;
                }
 
@@ -829,6 +832,7 @@ dkimf_load_replist(FILE *in, struct replace **list)
                {
                        fprintf(stderr, "%s: strdup(): %s\n", progname,
                                strerror(errno));
+                       free(newrep);
                        return FALSE;
                }

diff --git a/opendkim/opendkim.c b/opendkim/opendkim.c
--- a/opendkim/opendkim.c
+++ b/opendkim/opendkim.c
@@ -13394,13 +13394,10 @@ mlfi_body(SMFICTX *ctx, u_char *bodyp, size_t bodylen)
                return dkimf_libstatus(ctx, last, "dkim_body()", status);
 
 #ifdef SMFIS_SKIP
-       if (dfc->mctx_srhead != NULL && cc->cctx_milterv2 &&
-           dkimf_msr_minbody(dfc->mctx_srhead) == 0)
-                       return SMFIS_SKIP;
-
-       if (dfc->mctx_dkimv != NULL && cc->cctx_milterv2 &&
-           dkim_minbody(dfc->mctx_dkimv) == 0)
-                       return SMFIS_SKIP;
+       if (cc->cctx_milterv2 &&
+           (dfc->mctx_srhead == NULL || dkimf_msr_minbody(dfc->mctx_srhead) == 0) &&
+           (dfc->mctx_dkimv == NULL || dkim_minbody(dfc->mctx_dkimv) == 0))
+               return SMFIS_SKIP;
 #endif /* SMFIS_SKIP */
 
        return SMFIS_CONTINUE;

diff --git a/opendkim/opendkim.c b/opendkim/opendkim.c
--- a/opendkim/opendkim.c
+++ b/opendkim/opendkim.c
@@ -4250,7 +4250,7 @@ dkimf_add_ar_fields(struct msgctx *dfc, struct dkimf_config *conf,
        assert(conf != NULL);
        assert(ctx != NULL);
 
-       if (dkimf_insheader(ctx, 1, AUTHRESULTSHDR,
+       if (dkimf_insheader(ctx, 0, AUTHRESULTSHDR,
                            (char *) dfc->mctx_dkimar) == MI_FAILURE)
        {
                if (conf->conf_dolog)
@@ -13511,7 +13511,7 @@ mlfi_eom(SMFICTX *ctx)
                         dkimf_lookup_inttostr(dfc->mctx_status,
                                               dkimf_statusstrings));
 
-               if (dkimf_insheader(ctx, 1, AUTHRESULTSHDR,
+               if (dkimf_insheader(ctx, 0, AUTHRESULTSHDR,
                                    (char *) header) == MI_FAILURE)
                {
                        if (conf->conf_dolog)
@@ -14956,7 +14956,7 @@ mlfi_eom(SMFICTX *ctx)
                                                        sizeof header);
                                        }
                
-                                       if (dkimf_insheader(ctx, 1,
+                                       if (dkimf_insheader(ctx, 0,
                                                            AUTHRESULTSHDR,
                                                            (char *) header) == MI_FAILURE)
                                        {
@@ -15159,7 +15159,7 @@ mlfi_eom(SMFICTX *ctx)
                        dkimf_stripcr((char *) start);
                        dkimf_dstring_cat(dfc->mctx_tmpstr, start);
 
-                       if (dkimf_insheader(ctx, 1, DKIM_SIGNHEADER,
+                       if (dkimf_insheader(ctx, 0, DKIM_SIGNHEADER,
                                            (char *) dkimf_dstring_get(dfc->mctx_tmpstr)) == MI_FAILURE)
                        {
                                if (conf->conf_dolog)
@@ -15195,7 +15195,7 @@ mlfi_eom(SMFICTX *ctx)
                /* add VBR-Info header if generated */
                if (dfc->mctx_vbrinfo != NULL)
                {
-                       if (dkimf_insheader(ctx, 1, VBR_INFOHEADER,
+                       if (dkimf_insheader(ctx, 0, VBR_INFOHEADER,
                                            dfc->mctx_vbrinfo) == MI_FAILURE)
                        {
                                if (conf->conf_dolog)

diff --git a/opendkim/README b/opendkim/README
--- a/opendkim/README
+++ b/opendkim/README
@@ -273,8 +273,8 @@ You could put "file:" in front of the filename for the KeyTable just to be
 precise, but "file:" is assumed if the value starts with a "/".
 
 
-HANDLING 8-BIT MESSAGES
-=======================
+HANDLING 8-BIT MESSAGES (Sendmail)
+==================================
 
 SMTP was not designed for handling of other than 7-bit ASCII, and the
 mechanisms to do so were added later.  There is considerable flexibility in
@@ -301,6 +301,37 @@ If the MTA connected to OpenDKIM is used to relay messages, e.g. as aliases,
 and the origianl sender set p=reject; DMARC policy, then the adjustment is
 counterproductive.
 
+NOTES ON POSTFIX  REWRITING OF MESSAGES
+=====================================
+Like other MIME-aware MTAs, Postfix downgrades 8bit body content to 7bit when
+a remote SMTP server does not announce 8BITMIME support.  If DKIM signatures
+must survive transmission to servers that don't announce 8BITMIME, Wietse
+recommends to downgrade before signing (for example, specify "-o
+smtp_discard_ehlo_keywords=8bitmime,silent-discard" for an SMTP client that
+delivers to a null filter or to amavisd).
+
+You could specify "disable_mime_output_conversion = no" locally, but that won't
+prevent remote MTAs from doing the 8bit to 7bit downgrade and breaking DKIM
+signatures.
+
+You prevent Postfix from adding From/Date/Message-ID headers, and from rewriting
+addresses in headers, by setting the -G flag for the sendmail command, and by
+setting local_header_rewrite_clients to empty (by default these modifications
+are enabled only for submissions by local processes and from clients in local
+networks).
+
+Otherwise, Postfix should not modify a well-formed email message.  For example,
+if the address in a from/to/etc. header is not modified, then the header is
+passed through unchanged regardless of the content of mailbox display names,
+comments, etc.
+
+However, there are no guarantees for out-of-spec email and for some obsolete
+forms. For example, Postfix will fold lines > 998 (not including the <CR><LF>) by
+inserting <CR><LF><SPACE> to minimize damage to MIME-formatted messages, will
+truncate (multiline) headers that contain >102400 bytes or >10240 tokens, and
+will replace the obsolete form "headername :" with the normal form "headername:"
+because many things in Postfix expect the normal form..
+
 TESTING
 =======