mailauth 0.3.1 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b16ed1cec4ffbdbe20c947b204e28b417003a2c175622b3cc404cb902fe48535
-  data.tar.gz: a2c0c00468a940c523d727339503bce49317f756db2c1a886659601a295efc49
+  metadata.gz: 49dfab12d1bcd9e138fd09d613b66d5ffa150cbd4d73ce381e10a07a6aa3e3f2
+  data.tar.gz: 99e7290474ee3fe5054e05b23041cdf93b9f91d174f7d7ed23dd7ded0743b9e1
 SHA512:
-  metadata.gz: 2a157fe9a86b4cc1e8ac95a433a0c31cc9235c71057900510be4426b37303b0b8099a23506ea46834693304923215e40c46b7c5a5b7843bfdf23445999835b54
-  data.tar.gz: e792cb0cc915924ecaa8205aa9023e756c9ad96e9ecec6ef9abd3653d634f875824b49ac5c8fc957e76ae192c3a11a75dff5da145809cbead1fc23f9353fbcfe
+  metadata.gz: 5381265ba7b84d464781bbca0428c1ceec111b93eea103095545301d381a4b4bfbfc55fb34bf47e5ffd8921700a531bb83d965dc3c3d087739a72452e53a7e3b
+  data.tar.gz: '06093aba36c61e9a818afc9c82749416cee178345136cc3473877d5bc5354dd460189bfa02963d82354e38a4ce168b8a07412421c7b78f7c19cf2d826a8835e5'

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.3.2
+
+- `permerror` rather than `pass` for an `rsa-sha1` signature, retired by RFC 8301 §3.1
+- At most ten DKIM signatures are verified per message
+
 ## 0.3.1
 
 - `temperror` when no nameserver is usable, rather than a raise

data/lib/mailauth/arc.rb

@@ -44,7 +44,7 @@ module MailAuth
       Dkim.parse_tags(value_of(field).to_s)
     end
 
-    # sha1 is still legal for a DKIM signature and never was for ARC.
+    # RFC 8617 never registered sha1; DKIM's list matches only since retiring it.
     def self.signing_algorithm?(algorithm)
       SIGNING_ALGORITHMS.include?(signing_algorithm(algorithm)) && HASHES.include?(hash_algorithm(algorithm))
     end

data/lib/mailauth/dkim.rb

@@ -17,7 +17,8 @@ module MailAuth
     # the algorithm is unsupported, or the key is unreadable.
     class Malformed < StandardError; end
 
-    HASHES = { "sha1" => OpenSSL::Digest::SHA1, "sha256" => OpenSSL::Digest::SHA256 }.freeze
+    # RFC 8301 §3.1 retired rsa-sha1: a verifier must not consider one valid.
+    HASHES = { "sha256" => OpenSSL::Digest::SHA256 }.freeze
     SIGNING_ALGORITHMS = %w[ rsa ed25519 ].freeze
 
     # What OpenSSL calls a key, mapped to what a= calls it.
@@ -29,6 +30,10 @@ module MailAuth
     # RFC 6376 §3.2: ALPHA *ALNUMPUNC.
     TAG_NAME = /\A[a-zA-Z][a-zA-Z0-9_]*\z/n
 
+    # RFC 6376 §8.4. Each signature costs a lookup for a key its sender named,
+    # and headers are cheap to write, so only the first so many are answered.
+    MAXIMUM_SIGNATURES = 10
+
     # Shorter RSA keys are factorable cheaply enough to prove nothing.
     MINIMUM_RSA_BITS = 1024
 
@@ -37,10 +42,20 @@ module MailAuth
     ED25519_SPKI_PREFIX = [ "302a300506032b6570032100" ].pack("H*")
 
     def self.verify(message, resolver: Resolver.new, now: Time.now)
-      signatures = message.fields_named("dkim-signature").map do |field|
+      fields = message.fields_named("dkim-signature")
+
+      signatures = fields.first(MAXIMUM_SIGNATURES).map do |field|
         Verification.new(message, field, resolver:, now:).result
       end
-      signatures << Signature.new(status: Status::NONE, comment: "message not signed") if signatures.empty?
+
+      # The ones left over are reported rather than dropped: a verifier that
+      # quietly ignores a signature says a message carried fewer than it did.
+      if fields.empty?
+        signatures << Signature.new(status: Status::NONE, comment: "message not signed")
+      elsif fields.length > MAXIMUM_SIGNATURES
+        signatures << Signature.new(status: Status::PERMERROR,
+          comment: "#{fields.length - MAXIMUM_SIGNATURES} more signatures not evaluated")
+      end
 
       DkimResult.new(signatures:)
     end

data/lib/mailauth/version.rb

@@ -1,3 +1,3 @@
 module MailAuth
-  VERSION = "0.3.1"
+  VERSION = "0.3.2"
 end

data/mailauth.gemspec

@@ -9,7 +9,7 @@ Gem::Specification.new do |spec|
   spec.authors = [ "Simon Lev" ]
 
   spec.summary = "Email authentication for Ruby."
-  spec.description = "Answers one question about a received message: is it really from who it says it's from?"
+  spec.description = "Answers one question about a received message: is it really from who it says it's from? Implements DKIM signing and verification, SPF, DMARC, and ARC."
 
   spec.homepage = "https://github.com/mailpiece/mailauth"
   spec.license = "MIT"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mailauth
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.3.2
 platform: ruby
 authors:
 - Simon Lev
@@ -52,7 +52,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0.2'
 description: 'Answers one question about a received message: is it really from who
-  it says it''s from?'
+  it says it''s from? Implements DKIM signing and verification, SPF, DMARC, and ARC.'
 executables: []
 extensions: []
 extra_rdoc_files: []