You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2010/01/16 16:16:03 UTC
[Bug 6287] New: DKIM validation fails with "PUBLIC KEY: UNSUPPORTED
KEY TYPE"
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6287
Summary: DKIM validation fails with "PUBLIC KEY: UNSUPPORTED
KEY TYPE"
Product: Spamassassin
Version: 3.2.5
Platform: PC
OS/Version: Linux
Status: NEW
Severity: normal
Priority: P5
Component: Plugins
AssignedTo: dev@spamassassin.apache.org
ReportedBy: mnalis-sabug@voyager.hr
Created an attachment (id=4645)
--> (https://issues.apache.org/SpamAssassin/attachment.cgi?id=4645)
example e-mail which fails DKIM validation
Although DKIM validation works OK for some sites, for some it fails with
"unsupported key type".
Error looks like this:
[1353] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dkim.cf
[1353] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dkim.cf" for
included file
[1353] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/25_dkim.cf
[1353] dbg: config: fixed relative path:
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dkim.cf
[1353] dbg: config: using
"/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dkim.cf"
for included file
[1353] dbg: config: read file
/var/lib/spamassassin/3.002005/updates_spamassassin_org/60_whitelist_dkim.cf
[1353] dbg: dkim: performing public key lookup and signature verification
[1353] dbg: dkim: signing identity: no-reply@kiva.org, d=kiva.org, a=rsa-sha1,
c=nofws
[1353] dbg: dkim: signing identity: @kiva.org, d=kiva.org, a=rsa-sha1,
c=simple/simple
[1353] dbg: dkim: signature verification result: INVALID (PUBLIC KEY:
UNSUPPORTED KEY TYPE)
[1353] dbg: dkim: FAILED author signature by id no-reply@kiva.org, author
no-reply@kiva.org, MATCHES whitelist_auth ^.*\@kiva\.org$
[1353] dbg: dkim: FAILED author signature by id no-reply@kiva.org, author
no-reply@kiva.org, no valid matches
[1353] dbg: dkim: FAILED author signature by id @kiva.org, author
no-reply@kiva.org, MATCHES whitelist_auth ^.*\@kiva\.org$
[1353] dbg: dkim: FAILED author signature by id @kiva.org, author
no-reply@kiva.org, no valid matches
[1353] dbg: dkim: author no-reply@kiva.org, found in whitelist_auth BUT IGNORED
[1353] dbg: dkim: policy: performing lookup
[1353] dbg: dkim: policy result neutral: o=~
Why is this public key type unsupported, and can that be fixed ?
System is Debian Lenny (AMD64), spamassin is 3.2.5-2+lenny1.1~volatile1.
Validation fails with same error both with default Lenny libmail-dkim-perl
(0.32-1) and with the newer one from squeeze (0.37-1)
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6287] [review] DKIM validation fails with "PUBLIC KEY:
UNSUPPORTED KEY TYPE"
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6287
Justin Mason <jm...@jmason.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Group|security |
Component|Security |Libraries
AssignedTo|security@spamassassin.apach |dev@spamassassin.apache.org
|e.org |
--- Comment #5 from Justin Mason <jm...@jmason.org> 2010-01-27 03:16:33 UTC ---
reassigning, too
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6287] [review] DKIM validation fails with "PUBLIC KEY:
UNSUPPORTED KEY TYPE"
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6287
Justin Mason <jm...@jmason.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jm@jmason.org
--- Comment #3 from Justin Mason <jm...@jmason.org> 2010-01-20 04:35:33 UTC ---
+1 for addition to 3.3.1, I guess
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6287] [review] DKIM validation fails with "PUBLIC KEY:
UNSUPPORTED KEY TYPE"
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6287
--- Comment #6 from Mark Martinec <Ma...@ijs.si> 2010-01-27 06:21:55 UTC ---
spamassassin-trunk$ svn -m 'Bug 6287: let the DKIM plugin log the selector too'
ci
Sending lib/Mail/SpamAssassin/Plugin/DKIM.pm
Committed revision 903656.
Needs one more vote for inclusion in 3.3.1.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6287] [review] DKIM validation fails with "PUBLIC KEY:
UNSUPPORTED KEY TYPE"
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6287
Kevin A. McGrail <km...@pccc.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |kmcgrail@pccc.com
--- Comment #9 from Kevin A. McGrail <km...@pccc.com> 2010-02-03 10:21:11 UTC ---
(In reply to comment #8)
> (In reply to comment #7)
> > > Needs one more vote for inclusion in 3.3.1.
> >
> > Let's get this trivial one off the dashboard please...
>
> I wonder if we can just do lazy approval in cases like this -- if a week passes
> between [review], and you've already got one +1 and no -1's, we could just
> apply it. obviously nobody feels strongly about _not_ applying it ;)
Not sure about lazy consensus. I leave that answer to the parliamentarians.
But I think requiring votes is generally good.
However, this is a very straightforward dbg change so I'm +1.
KAM
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6287] DKIM validation fails with "PUBLIC KEY: UNSUPPORTED KEY
TYPE"
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6287
--- Comment #1 from Mark Martinec <Ma...@ijs.si> 2010-01-16 12:18:49 UTC ---
> Although DKIM validation works OK for some sites, for some it fails with
> "unsupported key type".
>
> [1353] dbg: dkim: signature verification result: INVALID (PUBLIC KEY:
> UNSUPPORTED KEY TYPE)
> Why is this public key type unsupported?
$ host -t txt kiva._domainkey.kiva.org
kiva._domainkey.kiva.org descriptive text "k=rs\; p=MIGfMA0G...AQAB"
Because 'rs' is not among the known key types as defined by RFC 4871
(section 3.6.1). So far the only know key type is 'rsa' (k=rsa, which
is a default anyway in the absence of a k tag).
> and can that be fixed ?
Certainly. Either let the kiva.org use the only known key type so far
(the 'rsa' type), or engage in the standardization process and add another
key type 'rs' to the set of recognized key types.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6287] [review] DKIM validation fails with "PUBLIC KEY:
UNSUPPORTED KEY TYPE"
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6287
--- Comment #8 from Justin Mason <jm...@jmason.org> 2010-02-03 10:06:02 UTC ---
(In reply to comment #7)
> > Needs one more vote for inclusion in 3.3.1.
>
> Let's get this trivial one off the dashboard please...
I wonder if we can just do lazy approval in cases like this -- if a week passes
between [review], and you've already got one +1 and no -1's, we could just
apply it. obviously nobody feels strongly about _not_ applying it ;)
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6287] [review] DKIM validation fails with "PUBLIC KEY:
UNSUPPORTED KEY TYPE"
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6287
Mark Martinec <Ma...@ijs.si> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P2 |P3
Status Whiteboard| |needs 1 vote for
| |improvement, then to be
| |closed as INVALID
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6287] [review] DKIM validation fails with "PUBLIC KEY:
UNSUPPORTED KEY TYPE"
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6287
Mark Martinec <Ma...@ijs.si> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P5 |P2
Target Milestone|Undefined |3.3.0
Summary|DKIM validation fails with |[review] DKIM validation
|"PUBLIC KEY: UNSUPPORTED |fails with "PUBLIC KEY:
|KEY TYPE" |UNSUPPORTED KEY TYPE"
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6287] [review] DKIM validation fails with "PUBLIC KEY:
UNSUPPORTED KEY TYPE"
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6287
Mark Martinec <Ma...@ijs.si> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |INVALID
--- Comment #10 from Mark Martinec <Ma...@ijs.si> 2010-02-03 10:29:30 UTC ---
Thank you!
svn -m 'Bug 6287: improved DKIM plugin debugging' ci
Sending lib/Mail/SpamAssassin/Plugin/DKIM.pm
Committed revision 906163.
Closing (the original issue) as invalid.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6287] [review] DKIM validation fails with "PUBLIC KEY:
UNSUPPORTED KEY TYPE"
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6287
Mark Martinec <Ma...@ijs.si> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P3 |P2
--- Comment #7 from Mark Martinec <Ma...@ijs.si> 2010-02-03 09:54:45 UTC ---
> Needs one more vote for inclusion in 3.3.1.
Let's get this trivial one off the dashboard please...
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6287] DKIM validation fails with "PUBLIC KEY: UNSUPPORTED KEY
TYPE"
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6287
--- Comment #2 from Mark Martinec <Ma...@ijs.si> 2010-01-16 16:48:39 UTC ---
Created an attachment (id=4647)
--> (https://issues.apache.org/SpamAssassin/attachment.cgi?id=4647)
patch to a dbg() call to improve diagnosability
A proposed patch to include a key type and a key selector to a dbg() call
in a DKIM plugin to allow diagnosing a public key problem based on a log
alone (with no sample message), and to avoid a warning on undef variable
in case of missing required tags in a signature. The changed dbg call
is only executed when debugging is enabled.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.