mailauth 4.6.1 → 4.6.2

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [4.6.2](https://github.com/postalsys/mailauth/compare/v4.6.1...v4.6.2) (2024-01-25)
+
+
+### Bug Fixes
+
+* **bimi:** skip bimi with oversized DKIM signatures ([d666d74](https://github.com/postalsys/mailauth/commit/d666d7476cbcae8b3161c78a7e737559ad112fd9))
+
 ## [4.6.1](https://github.com/postalsys/mailauth/compare/v4.6.0...v4.6.1) (2024-01-24)
 
 

package/lib/bimi/index.js

@@ -51,6 +51,13 @@ const lookup = async data => {
         return response;
     }
 
+    if (dmarc.alignment?.dkim?.overSized) {
+        response.status.result = 'skipped';
+        response.status.comment = 'Oversized DKIM signature';
+        response.info = formatAuthHeaderRow('bimi', response.status);
+        return response;
+    }
+
     const authorDomain = dmarc.status?.header?.from;
     const orgDomain = dmarc.domain;
 

package/lib/dkim/dkim-verifier.js

@@ -7,6 +7,7 @@ const { generateCanonicalizedHeader } = require('./header');
 const { getARChain } = require('../arc');
 const addressparser = require('nodemailer/lib/addressparser');
 const crypto = require('crypto');
+const { v4: uuidv4 } = require('uuid');
 
 class DkimVerifier extends MessageParser {
     constructor(options) {
@@ -204,7 +205,9 @@ class DkimVerifier extends MessageParser {
                 };
 
                 if (signatureHeader.type === 'DKIM' && this.headerFrom?.length) {
-                    status.aligned = this.headerFrom?.length ? getAlignment(this.headerFrom[0].split('@').pop(), [signatureHeader.signingDomain]) : false;
+                    status.aligned = this.headerFrom?.length
+                        ? getAlignment(this.headerFrom[0].split('@').pop(), [signatureHeader.signingDomain])?.domain || false
+                        : false;
                 }
 
                 let bodyHash = this.bodyHashes.get(signatureHeader.bodyHashKey)?.hash;
@@ -305,6 +308,9 @@ class DkimVerifier extends MessageParser {
                 }
 
                 let result = {
+                    id: signatureHeader.parsed?.b?.value
+                        ? crypto.createHash('sha256').update(Buffer.from(signatureHeader.parsed?.b?.value, 'base64')).digest('hex')
+                        : uuidv4(),
                     signingDomain: signatureHeader.signingDomain,
                     selector: signatureHeader.selector,
                     signature: signatureHeader.parsed?.b?.value,
@@ -331,6 +337,9 @@ class DkimVerifier extends MessageParser {
                 if (typeof signatureHeader.maxBodyLength === 'number') {
                     result.canonBodyLengthLimited = true;
                     result.canonBodyLengthLimit = signatureHeader.maxBodyLength;
+                    if (result.canonBodyLengthTotal > result.canonBodyLength) {
+                        status.overSized = result.canonBodyLengthTotal - result.canonBodyLength;
+                    }
                 } else {
                     result.canonBodyLengthLimited = false;
                 }

package/lib/dmarc/verify.js

@@ -101,8 +101,8 @@ const verifyDmarc = async opts => {
         rr: dmarcRecord.rr,
 
         alignment: {
-            spf: { result: spfAlignment, strict: dmarcRecord.aspf === 's' },
-            dkim: { result: dkimAlignment, strict: dmarcRecord.adkim === 's' }
+            spf: { result: spfAlignment?.domain, strict: dmarcRecord.aspf === 's' },
+            dkim: { result: dkimAlignment?.domain, strict: dmarcRecord.adkim === 's', overSized: dkimAlignment?.overSized }
         }
     });
 };

package/lib/mailauth.js

@@ -119,7 +119,14 @@ const authenticate = async (input, opts) => {
         dmarcResult = await dmarc({
             headerFrom: dkimResult.headerFrom,
             spfDomains: [].concat((spfResult && spfResult.status.result === 'pass' && spfResult.domain) || []),
-            dkimDomains: (dkimResult.results || []).filter(r => r.status.result === 'pass').map(r => r.signingDomain),
+            dkimDomains: (dkimResult.results || [])
+                .filter(r => r.status.result === 'pass')
+                .map(r => ({
+                    id: r.id,
+                    domain: r.signingDomain,
+                    aligned: r.status.aligned,
+                    overSized: r.status.overSized
+                })),
             arcResult,
             resolver: opts.resolver
         });

package/lib/tools.js

@@ -398,6 +398,10 @@ const formatAuthHeaderRow = (method, status) => {
 
     parts.push(`${method}=${status.result || 'none'}`);
 
+    if (status.overSized) {
+        parts.push(`(${escapeCommentValue(`oversized signature ${status.overSized}B`)})`);
+    }
+
     if (status.comment) {
         parts.push(`(${escapeCommentValue(status.comment)})`);
     }
@@ -443,23 +447,32 @@ const formatDomain = domain => {
 };
 
 const getAlignment = (fromDomain, domainList, strict) => {
-    domainList = [].concat(domainList || []);
+    domainList = []
+        .concat(domainList || [])
+        .map(entry => {
+            if (typeof entry === 'string') {
+                return { domain: entry };
+            }
+            return entry;
+        })
+        .sort((a, b) => (a.overSized || 0) - (b.overSized || 0));
+
     if (strict) {
         fromDomain = formatDomain(fromDomain);
-        for (let domain of domainList) {
-            domain = formatDomain(psl.get(domain) || domain);
+        for (let entry of domainList) {
+            let domain = formatDomain(psl.get(entry.domain) || entry.domain);
             if (formatDomain(domain) === fromDomain) {
-                return domain;
+                return entry;
             }
         }
     }
 
     // match org domains
     fromDomain = formatDomain(psl.get(fromDomain) || fromDomain);
-    for (let domain of domainList) {
-        domain = formatDomain(psl.get(domain) || domain);
+    for (let entry of domainList) {
+        let domain = formatDomain(psl.get(entry.domain) || entry.domain);
         if (domain === fromDomain) {
-            return domain;
+            return entry;
         }
     }
 

package/man/mailauth.1

@@ -1,4 +1,4 @@
-.TH "MAILAUTH" "1" "January 2024" "v4.6.1" "Mailauth Help"
+.TH "MAILAUTH" "1" "January 2024" "v4.6.2" "Mailauth Help"
 .SH "NAME"
 \fBmailauth\fR
 .QP

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailauth",
-    "version": "4.6.1",
+    "version": "4.6.2",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "scripts": {
@@ -56,6 +56,7 @@
         "psl": "1.9.0",
         "punycode": "2.3.1",
         "undici": "5.28.2",
+        "uuid": "9.0.1",
         "yargs": "17.7.2"
     },
     "engines": {