ARC: Fix verification to do AS checks in reverse order

Broken from the original introduction (617d39327e)

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index da162a04f17ecd55311d46ca2bebdbdfbb4c9dec..fff417f05f224c96c2ef4c49ade60017d4f8390b 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -39,6 +39,8 @@ JH/10 Fix ARC signing for case when DKIM signing failed.  Previously this would
 
 JH/14 Bug 2284: Fix DKIM signing for body lines starting with a pair of dots.
 
+JH/16 Fix ARC verification to do AS checks in reverse order.
+
 
 Exim version 4.91
 -----------------

diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index 0eeb2275897d9783a03d1f2f8c459af84d48c2ce..95272f43fdc220aa1cfb6268ef8c5f091441b451 100644 (file)
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -805,18 +805,24 @@ An option on the smtp transport, which constructs and prepends to the message
 an ARC set of headers.  The textually-first Authentication-Results: header
 is used as a basis (you must have added one on entry to the ADMD).
 Expanded as a whole; if unset, empty or forced-failure then no signing is done.
-If it is set, all three elements must be non-empty.
+If it is set, all of the first three elements must be non-empty.
 
 Caveats:
  * There must be an Authentication-Results header, presumably added by an ACL
    while receiving the message, for the same ADMD, for arc_sign to succeed.
    This requires careful coordination between inbound and outbound logic.
+
+   Only one A-R header is taken account of.  This is a limitation versus
+   the ARC spec (which says that all A-R headers from within the ADMD must
+   be used).
+
  * If passing a message to another system, such as a mailing-list manager
    (MLM), between receipt and sending, be wary of manipulations to headers made
    by the MLM.
    + For instance, Mailman with REMOVE_DKIM_HEADERS==3 might improve
      deliverability in a pre-ARC world, but that option also renames the
      Authentication-Results header, which breaks signing.
+
  * Even if you use multiple DKIM keys for different domains, the ARC concept
    should try to stick to one ADMD, so pick a primary domain and use that for
    AR headers and outbound signing.

diff --git a/src/src/arc.c b/src/src/arc.c
index c2e7e5080a1dce815478c0bf75018cb0436ca646..3bde81e2bed6e35c580a10f5fffc7fc7c0afc3c8 100644 (file)
--- a/src/src/arc.c
+++ b/src/src/arc.c
@@ -966,16 +966,13 @@ return NULL;
 static const uschar *
 arc_verify_seals(arc_ctx * ctx)
 {
-arc_set * as = ctx->arcset_chain;
+arc_set * as = ctx->arcset_chain_last;
 
 if (!as)
   return US"none";
 
-while (as)
-  {
-  if (arc_seal_verify(ctx, as)) return US"fail";
-  as = as->next;
-  }
+for ( ; as; as = as->prev) if (arc_seal_verify(ctx, as)) return US"fail";
+
 DEBUG(D_acl) debug_printf("ARC: AS vfy overall pass\n");
 return NULL;
 }