dkimverify 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: be888e240c37308c063950bd2bab4b67c28d0b62
-  data.tar.gz: 2726298b7ec6e5ac4dc7c00392908de20ad33744
+  metadata.gz: ab8514ab9b191b18c0d9eab8d3f37b246555f4fd
+  data.tar.gz: 0d6203cb46b3f520f63f8b301da4c586208076ac
 SHA512:
-  metadata.gz: 33a309ba077205dd8d3683a6460a9bc89afc6177cbef24601628b2368886ebd81fae09ed500b6333bc7973f91e4c3d7a5297514fc0615e60f3ceb14e966acd15
-  data.tar.gz: 7078d239bbc4d4a2efbccbcd1c36b7267945d70150937245f1397d463da747837e65f6e77c80592077e7108104655b76717ebb6aa427071bd95037e20faf2d17
+  metadata.gz: b7eb314c2b983b38c2cdf98acb94c5197c3c122559e1eb0dc613dea75fec14ea3fa2da7aff2025ee20767a1e1962ba51dafb29935df0b2b8ae3fe51e1299a5b2
+  data.tar.gz: 5c0c5ce840fa47bf365f6bb2822af363fe720a980f7e0203bef47b3675e7a98a463adae22d973bb8e7b58590b97607c03360d786775d36d32bc1d7f444701d3a

data/.gitignore

@@ -1,4 +1,5 @@
 pydkim
+ruby_failures_python_successes.txt
 *.gem
 Gemfile.lock # becuase this is a gem and apparently you're not supposed to check that in for gems
 Gemfile.lock

data/README.md

@@ -5,6 +5,21 @@ a gem for verifying DKIM signatures in Ruby
 
 this gem does not sign mail messages (but a PR to enable it would likely be accepted, I just have no use for it.)
 
+how to use
+-----------
+````Dkim::Verifier.new(eml_filepath).verify!````
+
+the `verify!` method will return:
+
+- `true` if the signature verifies
+- `false` if no signature is present, and,
+- raise `Dkim::DkimError` (or a child error) if the signature is present but does not verify.
+
+loading emails from a string is not yet implemented, but would be really easy (send me a PR!)
+
+
+
+
 with a debt of gratitude to:
 ----------------------------
 
@@ -19,6 +34,7 @@ not yet implemented
 checking expiration dates (x=, t=)
 accounting for length limits (l= tag)
 tests (which I really ought to add)
+checking multiple dkim signature header lines (probably easy)
 
 by
 --

data/dkimverify.gemspec

@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |gem|
   gem.name          = "dkimverify"
-  gem.version       = '0.0.1'
+  gem.version       = '0.0.2'
   gem.authors       = ["Jeremy B. Merrill"]
   gem.license       = "MIT"
   gem.email         = ["jeremybmerrill@gmail.com"]
@@ -10,7 +10,7 @@ Gem::Specification.new do |gem|
   gem.summary       = %q{ A pure-Ruby library for validating/verifying DKIM signatures. }
   gem.homepage      = "https://github.com/jeremybmerrill/dkimverify"
   gem.files         = `git ls-files`.split($/)
-  gem.require_paths = ["dkim-query"]
+  gem.require_paths = ["dkim-query", "."]
   gem.add_dependency "mail", "2.6.4"
   gem.add_dependency "parslet", "~> 1.6"
 end

data/dkimverify.rb

@@ -1,4 +1,3 @@
-require 'mail'
 require 'digest'
 require 'openssl'
 require 'base64'
@@ -7,6 +6,15 @@ require_relative './dkim-query/lib/dkim/query'
 
 # TODO make this an option somehow
 $debuglog = nil # alternatively, set this to `STDERR` to log to stdout.
+require 'mail'
+
+module Mail
+    class Header
+        def first_field(name)
+            self[name].class == Array ? self[name].first : self[name]
+        end
+    end
+end
 
 module Dkim
     # what are these magic numbers?!
@@ -20,15 +28,23 @@ module Dkim
     HASHID_SHA256 = OpenSSL::ASN1::ObjectId.new('sha256')
 
     class DkimError < StandardError; end
-    class InvalidDkimSignature < DkimError; end
-    class DkimVerificationFailure < DkimError; end
+    class DkimTempFail < DkimError; end
+    class DkimPermFail < DkimError; end
+    class InvalidDkimSignature < DkimPermFail; end
+    class DkimVerificationFailure < DkimPermFail; end
 
     class Verifier
         def initialize(email_filename)
-            mail = Mail.read(email_filename)
+            mail = Mail.read(email_filename) # TODO make this `mail` not `@mail`
             @headers = mail.header
             @body = mail.body.raw_source
-            dkim_signature_str = @headers["DKIM-Signature"].value.to_s
+        end
+
+
+        def verify!
+            return false if @headers["DKIM-Signature"].nil?
+
+            dkim_signature_str = @headers.first_field("DKIM-Signature").value.to_s
             @dkim_signature = {}
             dkim_signature_str.split(/\s*;\s*/).each do |key_val| 
                 if m = key_val.match(/(\w+)\s*=\s*(.*)/)
@@ -36,10 +52,7 @@ module Dkim
                 end
             end
             validate_signature! # just checking to make sure we have all the ingredients we need to actually verify the signature
-        end
-
 
-        def verify!
             figure_out_canonicalization_methods!
             verify_body_hash!
 
@@ -68,7 +81,7 @@ module Dkim
                     elsif @dkim_signature['a'] == "rsa-sha256"
                       [Digest::SHA256, HASHID_SHA256]
                     else
-                      puts "couldn't figure out the right algorithm to use"
+                      $debuglog.puts "couldn't figure out the right algorithm to use"
                       exit 1
                     end
             
@@ -109,6 +122,7 @@ module Dkim
             # here we're getting the website's actual public key from the DNS system
             # s = dnstxt(sig['s']+"._domainkey."+sig['d']+".")
             dkim_record_from_dns = DKIM::Query::Domain.query(@dkim_signature['d'], {:selectors => [@dkim_signature['s']]}).keys[@dkim_signature['s']]
+            raise DkimTempFail.new("couldn't get public key from DNS system for #{@dkim_signature['s']}/#{@dkim_signature['d']}") if dkim_record_from_dns.nil? || dkim_record_from_dns.class == DKIM::Query::MalformedKey
             x = OpenSSL::ASN1.decode(Base64.decode64(dkim_record_from_dns.public_key.to_s))
             publickey = x.value[1].value
         end
@@ -119,18 +133,19 @@ module Dkim
             header_fields_to_include = @dkim_signature['h'].split(/\s*:\s*/)
             $debuglog.puts "header_fields_to_include: #{header_fields_to_include}" unless $debuglog.nil?
             canonicalized_headers = []
-            canonicalized_headers = Dkim.canonicalize_headers(header_fields_to_include.map{|header_name| [header_name, @headers[header_name].value] }, @how_to_canonicalize_headers)
-            # def _remove(s, t):
-            #     i = s.find(t)
-            #     assert i >= 0
-            #     return s[:i] + s[i+len(t):]
-
+            header_fields_to_include_with_values = header_fields_to_include.map do |header_name|                                
+                [header_name, @headers.first_field(header_name).instance_eval { unfold(split(@raw_value)[1]) } ] 
+                # .value and .instance_eval { unfold(split(@raw_value)[1]) } return subtly different values
+                # if the value of the Date header is a date with a single-digit day.
+                # see https://github.com/mikel/mail/issues/1075
+                # incidentally, .instance_variable_get("@value") gives a third subtly different value in a way that I don't understand.
+            end
+            canonicalized_headers = Dkim.canonicalize_headers(header_fields_to_include_with_values, @how_to_canonicalize_headers)
 
-            # The call to _remove() assumes that the signature b= only appears once in the signature header
             canonicalized_headers += Dkim.canonicalize_headers([
                 [
-                    @headers["DKIM-Signature"].name.to_s, 
-                    @headers["DKIM-Signature"].value.to_s.split(@dkim_signature['b']).join('')
+                    @headers.first_field("DKIM-Signature").name.to_s, 
+                    @headers.first_field("DKIM-Signature").value.to_s.split(@dkim_signature['b']).join('')
                 ]
             ], @how_to_canonicalize_headers).map{|x| [x[0], x[1].rstrip()] }
 
@@ -144,8 +159,7 @@ module Dkim
                     elsif @dkim_signature['a'] == "rsa-sha256"
                       Digest::SHA256
                     else
-                      puts "couldn't figure out the right algorithm to use"
-                      exit 1
+                      raise InvalidDkimSignature.new "couldn't figure out the right algorithm to use"
                     end.new
             headers_to_sign.each do |header|
                 hasher.update(header[0])
@@ -153,7 +167,7 @@ module Dkim
                 hasher.update(header[1])
             end
             digest = hasher.digest
-            $debuglog.puts "verify digest: #{  Base64.encode64(digest)  }" unless $debuglog.nil?
+            $debuglog.puts "verify digest: #{  digest.each_byte.map { |b| b.to_s(16) }.join ' ' }" unless $debuglog.nil?
             digest
         end
         
@@ -247,10 +261,10 @@ end
 if __FILE__ == $0
     emlfn = ARGV[0] || "/Users/204434/code/stevedore-uploader-internal/inputs/podesta-part36/59250.eml"
     begin
-        Dkim::Verifier.new(emlfn).verify!
-    rescue Dkim::DkimError
+        ret = Dkim::Verifier.new(emlfn).verify!
+    rescue Dkim::DkimPermFail
         puts "uh oh, something went wrong, the signature did not verify correctly"
         exit 1
     end
-    puts "signature verified correctly"
+    puts ret ? "DKIM signature verified correctly" : "DKIM signature absent"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dkimverify
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Jeremy B. Merrill
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-01-25 00:00:00.000000000 Z
+date: 2017-01-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mail
@@ -85,6 +85,7 @@ post_install_message:
 rdoc_options: []
 require_paths:
 - dkim-query
+- "."
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="