[Fix] Allow oversigning in DKIM signatures

diff --git a/src/libserver/dkim.c b/src/libserver/dkim.c
index 0f296eaab596003bcb825ba94ae95ef2622dc2d3..a9c4ae66f1ed37d765ecc617850828dff50f7cab 100644 (file)
--- a/src/libserver/dkim.c
+++ b/src/libserver/dkim.c
@@ -2090,7 +2090,10 @@ rspamd_dkim_canonize_header (struct rspamd_dkim_common_ctx *ctx,
                                rh_num = ar->len - count - 1;
                        }
                        else {
-                               /* Absence of header is just NULL signature update */
+                               /*
+                                * If DKIM has less headers requested than there are in a
+                                * message, then it's fine, it allows adding extra headers
+                                */
                                return TRUE;
                        }
 
@@ -2791,10 +2794,11 @@ rspamd_dkim_sign (struct rspamd_task *task, const gchar *selector,
                if (g_hash_table_lookup (task->raw_headers, dh->name)) {
                        rspamd_dkim_canonize_header (&ctx->common, task, dh->name, dh->count,
                                        NULL, NULL);
+               }
 
-                       for (j = 0; j < dh->count + 1; j++) {
-                               rspamd_printf_gstring (hdr, "%s:", dh->name);
-                       }
+               /* We allow oversigning if dh->count > number of headers with this name */
+               for (j = 0; j < dh->count + 1; j++) {
+                       rspamd_printf_gstring (hdr, "%s:", dh->name);
                }
        }