mailauth 4.6.0 → 4.6.2

package/.ncurc.js

@@ -0,0 +1,12 @@
+module.exports = {
+    upgrade: true,
+    reject: [
+        'marked',
+        'marked-man',
+        // only works as ESM
+        'chai',
+
+        // Fails in Node 16
+        'undici'
+    ]
+};

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [4.6.2](https://github.com/postalsys/mailauth/compare/v4.6.1...v4.6.2) (2024-01-25)
+
+
+### Bug Fixes
+
+* **bimi:** skip bimi with oversized DKIM signatures ([d666d74](https://github.com/postalsys/mailauth/commit/d666d7476cbcae8b3161c78a7e737559ad112fd9))
+
+## [4.6.1](https://github.com/postalsys/mailauth/compare/v4.6.0...v4.6.1) (2024-01-24)
+
+
+### Bug Fixes
+
+* **dkim-verify:** Show the length of the source body in DKIM results ([d28663b](https://github.com/postalsys/mailauth/commit/d28663b30b0bfaf07d395e9d3eaea044c9085657))
+
 ## [4.6.0](https://github.com/postalsys/mailauth/compare/v4.5.2...v4.6.0) (2023-11-02)
 
 

package/lib/bimi/index.js

@@ -51,6 +51,13 @@ const lookup = async data => {
         return response;
     }
 
+    if (dmarc.alignment?.dkim?.overSized) {
+        response.status.result = 'skipped';
+        response.status.comment = 'Oversized DKIM signature';
+        response.info = formatAuthHeaderRow('bimi', response.status);
+        return response;
+    }
+
     const authorDomain = dmarc.status?.header?.from;
     const orgDomain = dmarc.domain;
 

package/lib/dkim/body/relaxed.js

@@ -26,9 +26,14 @@ class RelaxedHash {
         this.bodyHash = crypto.createHash(algorithm);
 
         this.remainder = false;
-        this.byteLength = 0;
 
+        // total body size
+        this.byteLength = 0;
+        // total canonicalized body size
+        this.canonicalizedLength = 0;
+        // hashed canonicalized body size (after l= tag)
         this.bodyHashedBytes = 0;
+
         this.maxBodyLength = maxBodyLength;
 
         this.maxSizeReached = maxBodyLength === 0;
@@ -37,6 +42,8 @@ class RelaxedHash {
     }
 
     _updateBodyHash(chunk) {
+        this.canonicalizedLength += chunk.length;
+
         if (this.maxSizeReached) {
             return;
         }

package/lib/dkim/body/simple.js

@@ -18,8 +18,12 @@ class SimpleHash {
         this.bodyHash = crypto.createHash(algorithm);
 
         this.remainder = [];
-        this.byteLength = 0;
 
+        // total body size
+        this.byteLength = 0;
+        // total canonicalized body size
+        this.canonicalizedLength = 0;
+        // hashed canonicalized body size (after l= tag)
         this.bodyHashedBytes = 0;
 
         this.maxBodyLength = maxBodyLength;
@@ -29,6 +33,8 @@ class SimpleHash {
     }
 
     _updateBodyHash(chunk) {
+        this.canonicalizedLength += chunk.length;
+
         if (this.maxSizeReached) {
             return;
         }

package/lib/dkim/dkim-signer.js

@@ -259,7 +259,9 @@ class DkimSigner extends MessageParser {
                     // value for the l= tag (if needed)
                     typeof signatureData.maxBodyLength === 'number'
                         ? {
-                              bodyHashedBytes: this.bodyHashes.get(hashKey).hasher.bodyHashedBytes
+                              bodyHashedBytes: this.bodyHashes.get(hashKey).hasher.bodyHashedBytes,
+                              canonicalizedLength: this.bodyHashes.get(hashKey).hasher.canonicalizedLength,
+                              sourceBodyLength: this.bodyHashes.get(hashKey).hasher.byteLength
                           }
                         : {}
                 )

package/lib/dkim/dkim-verifier.js

@@ -7,6 +7,7 @@ const { generateCanonicalizedHeader } = require('./header');
 const { getARChain } = require('../arc');
 const addressparser = require('nodemailer/lib/addressparser');
 const crypto = require('crypto');
+const { v4: uuidv4 } = require('uuid');
 
 class DkimVerifier extends MessageParser {
     constructor(options) {
@@ -204,7 +205,9 @@ class DkimVerifier extends MessageParser {
                 };
 
                 if (signatureHeader.type === 'DKIM' && this.headerFrom?.length) {
-                    status.aligned = this.headerFrom?.length ? getAlignment(this.headerFrom[0].split('@').pop(), [signatureHeader.signingDomain]) : false;
+                    status.aligned = this.headerFrom?.length
+                        ? getAlignment(this.headerFrom[0].split('@').pop(), [signatureHeader.signingDomain])?.domain || false
+                        : false;
                 }
 
                 let bodyHash = this.bodyHashes.get(signatureHeader.bodyHashKey)?.hash;
@@ -296,6 +299,8 @@ class DkimVerifier extends MessageParser {
                 }
 
                 signatureHeader.bodyHashedBytes = this.bodyHashes.get(signatureHeader.bodyHashKey)?.bodyHashedBytes;
+                signatureHeader.canonicalizedLength = this.bodyHashes.get(signatureHeader.bodyHashKey)?.canonicalizedLength;
+                signatureHeader.sourceBodyLength = this.bodyHashes.get(signatureHeader.bodyHashKey)?.byteLength;
 
                 if (typeof signatureHeader.maxBodyLength === 'number' && signatureHeader.maxBodyLength !== signatureHeader.bodyHashedBytes) {
                     status.result = 'fail';
@@ -303,6 +308,9 @@ class DkimVerifier extends MessageParser {
                 }
 
                 let result = {
+                    id: signatureHeader.parsed?.b?.value
+                        ? crypto.createHash('sha256').update(Buffer.from(signatureHeader.parsed?.b?.value, 'base64')).digest('hex')
+                        : uuidv4(),
                     signingDomain: signatureHeader.signingDomain,
                     selector: signatureHeader.selector,
                     signature: signatureHeader.parsed?.b?.value,
@@ -314,12 +322,26 @@ class DkimVerifier extends MessageParser {
                     status
                 };
 
+                if (typeof signatureHeader.sourceBodyLength === 'number') {
+                    result.sourceBodyLength = signatureHeader.sourceBodyLength;
+                }
+
                 if (typeof signatureHeader.bodyHashedBytes === 'number') {
                     result.canonBodyLength = signatureHeader.bodyHashedBytes;
                 }
 
+                if (typeof signatureHeader.canonicalizedLength === 'number') {
+                    result.canonBodyLengthTotal = signatureHeader.canonicalizedLength;
+                }
+
                 if (typeof signatureHeader.maxBodyLength === 'number') {
-                    result.bodyLengthCount = signatureHeader.maxBodyLength;
+                    result.canonBodyLengthLimited = true;
+                    result.canonBodyLengthLimit = signatureHeader.maxBodyLength;
+                    if (result.canonBodyLengthTotal > result.canonBodyLength) {
+                        status.overSized = result.canonBodyLengthTotal - result.canonBodyLength;
+                    }
+                } else {
+                    result.canonBodyLengthLimited = false;
                 }
 
                 if (publicKey) {

package/lib/dmarc/verify.js

@@ -101,8 +101,8 @@ const verifyDmarc = async opts => {
         rr: dmarcRecord.rr,
 
         alignment: {
-            spf: { result: spfAlignment, strict: dmarcRecord.aspf === 's' },
-            dkim: { result: dkimAlignment, strict: dmarcRecord.adkim === 's' }
+            spf: { result: spfAlignment?.domain, strict: dmarcRecord.aspf === 's' },
+            dkim: { result: dkimAlignment?.domain, strict: dmarcRecord.adkim === 's', overSized: dkimAlignment?.overSized }
         }
     });
 };

package/lib/mailauth.js

@@ -119,7 +119,14 @@ const authenticate = async (input, opts) => {
         dmarcResult = await dmarc({
             headerFrom: dkimResult.headerFrom,
             spfDomains: [].concat((spfResult && spfResult.status.result === 'pass' && spfResult.domain) || []),
-            dkimDomains: (dkimResult.results || []).filter(r => r.status.result === 'pass').map(r => r.signingDomain),
+            dkimDomains: (dkimResult.results || [])
+                .filter(r => r.status.result === 'pass')
+                .map(r => ({
+                    id: r.id,
+                    domain: r.signingDomain,
+                    aligned: r.status.aligned,
+                    overSized: r.status.overSized
+                })),
             arcResult,
             resolver: opts.resolver
         });

package/lib/tools.js

@@ -398,6 +398,10 @@ const formatAuthHeaderRow = (method, status) => {
 
     parts.push(`${method}=${status.result || 'none'}`);
 
+    if (status.overSized) {
+        parts.push(`(${escapeCommentValue(`oversized signature ${status.overSized}B`)})`);
+    }
+
     if (status.comment) {
         parts.push(`(${escapeCommentValue(status.comment)})`);
     }
@@ -443,23 +447,32 @@ const formatDomain = domain => {
 };
 
 const getAlignment = (fromDomain, domainList, strict) => {
-    domainList = [].concat(domainList || []);
+    domainList = []
+        .concat(domainList || [])
+        .map(entry => {
+            if (typeof entry === 'string') {
+                return { domain: entry };
+            }
+            return entry;
+        })
+        .sort((a, b) => (a.overSized || 0) - (b.overSized || 0));
+
     if (strict) {
         fromDomain = formatDomain(fromDomain);
-        for (let domain of domainList) {
-            domain = formatDomain(psl.get(domain) || domain);
+        for (let entry of domainList) {
+            let domain = formatDomain(psl.get(entry.domain) || entry.domain);
             if (formatDomain(domain) === fromDomain) {
-                return domain;
+                return entry;
             }
         }
     }
 
     // match org domains
     fromDomain = formatDomain(psl.get(fromDomain) || fromDomain);
-    for (let domain of domainList) {
-        domain = formatDomain(psl.get(domain) || domain);
+    for (let entry of domainList) {
+        let domain = formatDomain(psl.get(entry.domain) || entry.domain);
         if (domain === fromDomain) {
-            return domain;
+            return entry;
         }
     }
 

package/man/mailauth.1

@@ -1,4 +1,4 @@
-.TH "MAILAUTH" "1" "November 2023" "v4.6.0" "Mailauth Help"
+.TH "MAILAUTH" "1" "January 2024" "v4.6.2" "Mailauth Help"
 .SH "NAME"
 \fBmailauth\fR
 .QP

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailauth",
-    "version": "4.6.0",
+    "version": "4.6.2",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "scripts": {
@@ -33,28 +33,30 @@
     },
     "homepage": "https://github.com/postalsys/mailauth",
     "devDependencies": {
-        "chai": "4.3.10",
-        "eslint": "8.52.0",
+        "chai": "4.4.1",
+        "eslint": "8.56.0",
         "eslint-config-nodemailer": "1.2.0",
-        "eslint-config-prettier": "9.0.0",
+        "eslint-config-prettier": "9.1.0",
         "js-yaml": "4.1.0",
         "license-report": "6.5.0",
         "marked": "0.7.0",
         "marked-man": "0.7.0",
         "mbox-reader": "1.1.5",
         "mocha": "10.2.0",
+        "npm-check-updates": "16.14.12",
         "pkg": "5.8.1"
     },
     "dependencies": {
         "@postalsys/vmc": "1.0.6",
-        "fast-xml-parser": "4.3.2",
+        "fast-xml-parser": "4.3.3",
         "ipaddr.js": "2.1.0",
-        "joi": "17.11.0",
+        "joi": "17.12.0",
         "libmime": "5.2.1",
-        "nodemailer": "6.9.7",
+        "nodemailer": "6.9.8",
         "psl": "1.9.0",
         "punycode": "2.3.1",
-        "undici": "5.27.0",
+        "undici": "5.28.2",
+        "uuid": "9.0.1",
         "yargs": "17.7.2"
     },
     "engines": {

package/.ncurc.json

@@ -1,4 +0,0 @@
-{
-    "upgrade": true,
-    "reject": ["marked", "marked-man"]
-}