mailauth 3.0.0 → 3.0.1

package/bin/mailauth.js

@@ -294,18 +294,25 @@ const argv = yargs(hideBin(process.argv))
         ['vmc'],
         'Validate VMC logo',
         yargs => {
-            yargs.option('authorityFile', {
-                alias: 'f',
-                type: 'string',
-                description: 'Path to a VMC file',
-                demandOption: false
-            });
-            yargs.option('authority', {
-                alias: 'a',
-                type: 'string',
-                description: 'URL to a VMC file',
-                demandOption: false
-            });
+            yargs
+                .option('authorityPath', {
+                    alias: 'p',
+                    type: 'string',
+                    description: 'Path to a VMC file',
+                    demandOption: false
+                })
+                .option('authority', {
+                    alias: 'a',
+                    type: 'string',
+                    description: 'URL to a VMC file',
+                    demandOption: false
+                })
+                .option('domain', {
+                    alias: 'd',
+                    type: 'string',
+                    description: 'Sending domain to validate',
+                    demandOption: false
+                });
         },
         argv => {
             commandVmc(argv)

package/cli.md

@@ -1,3 +1,7 @@
+![](https://github.com/postalsys/mailauth/raw/master/assets/mailauth.png)
+
+Command line utility and a [Node.js library](README.md) for email authentication.
+
 # CLI USAGE
 
 ## TOC
@@ -224,20 +228,22 @@ Where
 **Options**
 
 -   `--authority <url>` or `-a <url>` is the URL for the VMC resource
--   `--authorityFile <path>` or `-f <path>` is the cached file for the authority URL to avoid network requests
+-   `--authorityPath <path>` or `-p <path>` is the cached file for the authority URL to avoid network requests
+-   `--domain <domain>` or `-d <domain>` is the sender domain to compare the certificate against
 
 **Example**
 
 ```
-$ mailauth vmc -a https://amplify.valimail.com/bimi/time-warner/yV3KRIg4nJW-cnn.pem
+$ mailauth vmc -a https://amplify.valimail.com/bimi/time-warner/yV3KRIg4nJW-cnn.pem -d cnn.com
 {
   "url": "https://amplify.valimail.com/bimi/time-warner/yV3KRIg4nJW-cnn.pem",
   "success": true,
+  "domainVerified": true,
   "vmc": {
     "mediaType": "image/svg+xml",
     "hashAlgo": "sha1",
     "hashValue": "ea8c81da633c66a16262134a78576cdf067638e9",
-    "logoFile": "PD94bWwgdmVyc...",
+    "logoFile": "<2300B base64 encoded file>",
     "validHash": true,
     "certificate": {
       "subjectAltName": [
@@ -272,17 +278,17 @@ $ mailauth vmc -a https://amplify.valimail.com/bimi/time-warner/yV3KRIg4nJW-cnn.
 If the certificate verification fails, then the contents are not returned.
 
 ```
-$ mailauth vmc -f /path/to/random/cert-bundle.pem
+$ mailauth vmc -p /path/to/random/cert-bundle.pem
 {
   "success": false,
   "error": {
     "message": "Self signed certificate in certificate chain",
     "details": {
-      "subject": "CN=catchall.delivery",
-      "fingerprint": "35:EF:C9:9A:52:D5:A9:94:00:68:C6:D4:17:F1:26:61:01:0F:70:6D",
-      "fingerprint235": "09:AB:0F:6B:F5:4F:16:58:F8:94:80:DE:E2:1A:D1:47:CC:64:F2:BF:63:E7:73:E4:02:F9:D3:C3:F6:9E:CC:86",
-      "validFrom": "Jul  6 23:10:49 2022 GMT",
-      "validTo": "Oct  4 23:10:48 2022 GMT"
+      "subject": "CN=postal.vmc.local\nO=Postal Systems OU.\nC=EE",
+      "fingerprint": "CC:49:83:ED:3F:6B:77:45:5B:A5:3B:9E:EC:99:0E:A1:EF:D7:FF:97",
+      "fingerprint235": "D4:36:6F:B4:EF:2B:4F:9E:84:23:3D:F2:3A:F7:13:21:C6:C3:CF:CB:03:5F:BB:54:5B:69:A4:AC:6A:43:61:7D",
+      "validFrom": "Jul  9 06:13:33 2022 GMT",
+      "validTo": "Jul  9 06:13:33 2023 GMT"
     },
     "code": "SELF_SIGNED_CERT_IN_CHAIN"
   }

package/lib/bimi/index.js

@@ -2,7 +2,7 @@
 
 const crypto = require('crypto');
 const dns = require('dns');
-const { formatAuthHeaderRow, parseDkimHeaders } = require('../tools');
+const { formatAuthHeaderRow, parseDkimHeaders, formatDomain, getAlignment } = require('../tools');
 const Joi = require('joi');
 const packageData = require('../../package.json');
 const httpsSchema = Joi.string().uri({
@@ -244,26 +244,30 @@ const validateVMC = async bimiData => {
         return false;
     }
 
+    let selector = bimiData?.status?.header?.selector;
+    let d = bimiData?.status?.header?.d;
+
     let promises = [];
 
-    promises.push(downloadPromise(bimiData.location, bimiData.locationFile));
-    promises.push(downloadPromise(bimiData.authority, bimiData.authorityFile));
+    promises.push(downloadPromise(bimiData.location, bimiData.locationPath));
+    promises.push(downloadPromise(bimiData.authority, bimiData.authorityPath));
 
     if (!promises.length) {
         return false;
     }
 
-    let results = await Promise.allSettled(promises);
+    let [{ reason: locationError, value: locationValue, status: locationStatus }, { reason: authorityError, value: authorityValue, status: authorityStatus }] =
+        await Promise.allSettled(promises);
 
     let result = {};
-    if (results[0].value || results[0].reason) {
+    if (locationValue || locationError) {
         result.location = {
             url: bimiData.location,
-            success: results[0].status === 'fulfilled'
+            success: locationStatus === 'fulfilled'
         };
 
-        if (results[0].reason) {
-            let err = results[0].reason;
+        if (locationError) {
+            let err = locationError;
             result.location.error = { message: err.message };
             if (err.redirect) {
                 result.location.error.redirect = err.redirect;
@@ -274,18 +278,18 @@ const validateVMC = async bimiData => {
         }
 
         if (result.location.success) {
-            result.location.logoFile = results[0].value.toString('base64');
+            result.location.logoFile = locationValue.toString('base64');
         }
     }
 
-    if (results[1].value || results[1].reason) {
+    if (authorityValue || authorityError) {
         result.authority = {
             url: bimiData.authority,
-            success: results[1].status === 'fulfilled'
+            success: authorityStatus === 'fulfilled'
         };
 
-        if (results[1].reason) {
-            let err = results[1].reason;
+        if (authorityError) {
+            let err = authorityError;
             result.authority.error = { message: err.message };
             if (err.redirect) {
                 result.authority.error.redirect = err.redirect;
@@ -295,9 +299,57 @@ const validateVMC = async bimiData => {
             }
         }
 
-        if (results[1].value) {
+        if (authorityValue) {
             try {
-                result.authority.vmc = await vmc(results[1].value);
+                let vmcData = await vmc(authorityValue);
+
+                if (vmcData?.mediaType?.toLowerCase() !== 'image/svg+xml') {
+                    let error = new Error('Invalid media type for the logo file');
+                    error.details = {
+                        mediaType: vmcData.mediaType
+                    };
+                    error.code = 'INVALID_MEDIATYPE';
+                    throw error;
+                }
+
+                if (d) {
+                    // validate domain
+                    let selectorSet = [];
+                    let domainSet = [];
+                    vmcData?.certificate?.subjectAltName?.map(formatDomain)?.forEach(domain => {
+                        if (/\b_bimi\./.test(domain)) {
+                            selectorSet.push(domain);
+                        } else {
+                            domainSet.push(domain);
+                        }
+                    });
+
+                    let domainVerified = false;
+
+                    if (selector && selectorSet.includes(formatDomain(`${selector}._bimi.${d}`))) {
+                        domainVerified = true;
+                    } else {
+                        let alignedDomain = getAlignment(d, domainSet, false);
+                        if (alignedDomain) {
+                            domainVerified = true;
+                        }
+                    }
+
+                    if (!domainVerified) {
+                        let error = new Error('Domain can not be verified');
+                        error.details = {
+                            subjectAltName: vmcData?.certificate?.subjectAltName,
+                            selector,
+                            d
+                        };
+                        error.code = 'VMC_DOMAIN_MISMATCH';
+                        throw error;
+                    } else {
+                        result.authority.domainVerified = true;
+                    }
+                }
+
+                result.authority.vmc = vmcData;
             } catch (err) {
                 result.authority.success = false;
                 result.authority.error = { message: err.message };
@@ -313,7 +365,7 @@ const validateVMC = async bimiData => {
         if (result.location && result.location.success && result.authority.success) {
             try {
                 if (result.location.success && result.authority.vmc.hashAlgo && result.authority.vmc.validHash) {
-                    let hash = crypto.createHash(result.authority.vmc.hashAlgo).update(results[0].value).digest('hex');
+                    let hash = crypto.createHash(result.authority.vmc.hashAlgo).update(locationValue).digest('hex');
                     result.location.hashAlgo = result.authority.vmc.hashAlgo;
                     result.location.hashValue = hash;
                     result.authority.hashMatch = hash === result.authority.vmc.hashValue;

package/lib/commands/vmc.js

@@ -6,13 +6,18 @@ const fs = require('fs').promises;
 
 const cmd = async argv => {
     let bimiData = {};
-    if (argv.authorityFile) {
-        bimiData.authorityFile = await fs.readFile(argv.authorityFile);
+    if (argv.authorityPath) {
+        bimiData.authorityPath = await fs.readFile(argv.authorityPath);
     }
+
     if (argv.authority) {
         bimiData.authority = argv.authority;
     }
 
+    if (argv.domain) {
+        bimiData.status = { header: { d: argv.domain } };
+    }
+
     const result = await validateVMC(bimiData);
     process.stdout.write(JSON.stringify(result.authority, false, 2) + '\n');
 };

package/lib/tools.js

@@ -490,5 +490,6 @@ module.exports = {
 
     getAlignment,
 
-    formatRelaxedLine
+    formatRelaxedLine,
+    formatDomain
 };

package/licenses.txt

@@ -1,11 +1,12 @@
-name        license type               link                                              installed version  author
-----        ------------               ----                                              -----------------  ------
-@fidm/x509  MIT                        git+ssh://git@github.com/fidm/x509.git            1.2.1
-ipaddr.js   MIT                        git://github.com/whitequark/ipaddr.js.git         2.0.1              whitequark whitequark@whitequark.org
-joi         BSD-3-Clause               git://github.com/sideway/joi.git                  17.6.0
-libmime     MIT                        git://github.com/andris9/libmime.git              5.1.0              Andris Reinman andris@kreata.ee
-node-forge  (BSD-3-Clause OR GPL-2.0)  git+https://github.com/digitalbazaar/forge.git    1.3.1              Digital Bazaar, Inc. support@digitalbazaar.com http://digitalbazaar.com/
-nodemailer  MIT                        git+https://github.com/nodemailer/nodemailer.git  6.7.5              Andris Reinman
-psl         MIT                        git+ssh://git@github.com/lupomontero/psl.git      1.8.0              Lupo Montero lupomontero@gmail.com https://lupomontero.com/
-punycode    MIT                        git+https://github.com/bestiejs/punycode.js.git   2.1.1              Mathias Bynens https://mathiasbynens.be/
-yargs       MIT                        git+https://github.com/yargs/yargs.git            17.5.1
+name            license type               link                                                       installed version  author
+----            ------------               ----                                                       -----------------  ------
+@fidm/x509      MIT                        git+ssh://git@github.com/fidm/x509.git                     1.2.1
+@postalsys/vmc  MIT                        https://registry.npmjs.org/@postalsys/vmc/-/vmc-1.0.1.tgz  1.0.1              Postal Systems OÜ
+ipaddr.js       MIT                        git://github.com/whitequark/ipaddr.js.git                  2.0.1              whitequark whitequark@whitequark.org
+joi             BSD-3-Clause               git://github.com/sideway/joi.git                           17.6.0
+libmime         MIT                        git://github.com/andris9/libmime.git                       5.1.0              Andris Reinman andris@kreata.ee
+node-forge      (BSD-3-Clause OR GPL-2.0)  git+https://github.com/digitalbazaar/forge.git             1.3.1              Digital Bazaar, Inc. support@digitalbazaar.com http://digitalbazaar.com/
+nodemailer      MIT                        git+https://github.com/nodemailer/nodemailer.git           6.7.7              Andris Reinman
+psl             MIT                        git+ssh://git@github.com/lupomontero/psl.git               1.9.0              Lupo Montero lupomontero@gmail.com https://lupomontero.com/
+punycode        MIT                        git+https://github.com/bestiejs/punycode.js.git            2.1.1              Mathias Bynens https://mathiasbynens.be/
+yargs           MIT                        git+https://github.com/yargs/yargs.git                     17.5.1

package/man/mailauth.1

@@ -1,4 +1,4 @@
-.TH "MAILAUTH" "1" "July 2022" "v2.3.4" "Mailauth Help"
+.TH "MAILAUTH" "1" "July 2022" "v3.0.0" "Mailauth Help"
 .SH "NAME"
 \fBmailauth\fR
 .QP

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailauth",
-    "version": "3.0.0",
+    "version": "3.0.1",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "scripts": {
@@ -45,8 +45,7 @@
         "pkg": "5.7.0"
     },
     "dependencies": {
-        "@fidm/x509": "1.2.1",
-        "@postalsys/vmc": "1.0.1",
+        "@postalsys/vmc": "1.0.3",
         "ipaddr.js": "2.0.1",
         "joi": "17.6.0",
         "libmime": "5.1.0",