[pmg-devel] [PATCH pmg-api 1/1] [pmg-api]: fix #3098 : first check for exact domain match

[Daniel Berteaud]

When selecting the sending domain for the DKIM signature, we should first check for an exact match. If none is found, look for parent domains. This fixes the case where wrong signing domain can be added if sign_all is disabled and we sign both a parent and a child domain.

Signed-off-by: Daniel Berteaud <daniel at firewall-services.com>
---
 src/PMG/DKIMSign.pm | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/PMG/DKIMSign.pm b/src/PMG/DKIMSign.pm
index 7cb06a6..8fd9eed 100644
--- a/src/PMG/DKIMSign.pm
+++ b/src/PMG/DKIMSign.pm
@@ -69,6 +69,14 @@ sub signing_domain {
     my $dkimdomains = PVE::INotify::read_file('dkimdomains');
     $dkimdomains = PVE::INotify::read_file('domains') if !scalar(%$dkimdomains);
 
+    # First check for an exact match in the domain list
+    foreach my $domain (sort keys %$dkimdomains) {
+	if ( $input_domain eq $domain ) {
+	    $self->domain($domain);
+	    return 1;
+	}
+    }
+    # If no exact match is found, check for parent/child domains
     foreach my $domain (sort keys %$dkimdomains) {
 	if ( $input_domain =~ /\Q$domain\E$/i ) {
 	    $self->domain($domain);
-- 
2.26.2