mailauth 4.6.2 → 4.6.4

package/CHANGELOG.md

@@ -1,22 +1,33 @@
 # Changelog
 
-## [4.6.2](https://github.com/postalsys/mailauth/compare/v4.6.1...v4.6.2) (2024-01-25)
+## [4.6.4](https://github.com/postalsys/mailauth/compare/v4.6.3...v4.6.4) (2024-02-05)
 
 
 ### Bug Fixes
 
-* **bimi:** skip bimi with oversized DKIM signatures ([d666d74](https://github.com/postalsys/mailauth/commit/d666d7476cbcae8b3161c78a7e737559ad112fd9))
+* **ed25519:** Fixed ed25519 signing and verification ([40f1245](https://github.com/postalsys/mailauth/commit/40f12457d8f49f0ea21015fe4203b4de746ab7b8))
 
-## [4.6.1](https://github.com/postalsys/mailauth/compare/v4.6.0...v4.6.1) (2024-01-24)
+## [4.6.3](https://github.com/postalsys/mailauth/compare/v4.6.2...v4.6.3) (2024-01-26)
 
 
 ### Bug Fixes
 
-* **dkim-verify:** Show the length of the source body in DKIM results ([d28663b](https://github.com/postalsys/mailauth/commit/d28663b30b0bfaf07d395e9d3eaea044c9085657))
+* bumped 2022 in copyright notices to 2024 ([cc89823](https://github.com/postalsys/mailauth/commit/cc8982349d14b42a28581ebc52aa6de2e11b5be8))
 
-## [4.6.0](https://github.com/postalsys/mailauth/compare/v4.5.2...v4.6.0) (2023-11-02)
+## [4.6.2](https://github.com/postalsys/mailauth/compare/v4.6.1...v4.6.2) (2024-01-25)
+
+### Bug Fixes
+
+-   **bimi:** skip bimi with undersized DKIM signatures ([d666d74](https://github.com/postalsys/mailauth/commit/d666d7476cbcae8b3161c78a7e737559ad112fd9))
 
+## [4.6.1](https://github.com/postalsys/mailauth/compare/v4.6.0...v4.6.1) (2024-01-24)
+
+### Bug Fixes
+
+-   **dkim-verify:** Show the length of the source body in DKIM results ([d28663b](https://github.com/postalsys/mailauth/commit/d28663b30b0bfaf07d395e9d3eaea044c9085657))
+
+## [4.6.0](https://github.com/postalsys/mailauth/compare/v4.5.2...v4.6.0) (2023-11-02)
 
 ### Features
 
-* **deploy:** Set up automatic publishing ([f9b9c32](https://github.com/postalsys/mailauth/commit/f9b9c325e4dbac060114aa12c5887ea8c92c0bf8))
+-   **deploy:** Set up automatic publishing ([f9b9c32](https://github.com/postalsys/mailauth/commit/f9b9c325e4dbac060114aa12c5887ea8c92c0bf8))

package/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2020-2022 Postal Systems OÜ
+Copyright (c) 2020-2024 Postal Systems OÜ
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -470,6 +470,6 @@ const { authenticate } = require('mailauth');
 
 ## License
 
-© 2020-2022 Postal Systems OÜ
+© 2020-2024 Postal Systems OÜ
 
 Licensed under MIT license

package/lib/arc/index.js

@@ -146,7 +146,7 @@ const signAS = async (chain, entry, signatureData) => {
         .sign(
             // use `null` as algorithm to detect it from the key file
             signAlgo === 'rsa' ? algorithm : null,
-            canonicalizedHeader,
+            signAlgo === 'rsa' ? canonicalizedHeader : crypto.createHash('sha256').update(canonicalizedHeader).digest(),
             privateKey
         )
         .toString('base64');

package/lib/bimi/index.js

@@ -51,9 +51,9 @@ const lookup = async data => {
         return response;
     }
 
-    if (dmarc.alignment?.dkim?.overSized) {
+    if (dmarc.alignment?.dkim?.underSized) {
         response.status.result = 'skipped';
-        response.status.comment = 'Oversized DKIM signature';
+        response.status.comment = 'undersized DKIM signature';
         response.info = formatAuthHeaderRow('bimi', response.status);
         return response;
     }

package/lib/dkim/dkim-signer.js

@@ -1,6 +1,13 @@
 'use strict';
 
-const { getSigningHeaderLines, formatSignatureHeaderLine, defaultDKIMFieldNames, defaultARCFieldNames, validateAlgorithm } = require('../../lib/tools');
+const {
+    getSigningHeaderLines,
+    formatSignatureHeaderLine,
+    defaultDKIMFieldNames,
+    defaultARCFieldNames,
+    validateAlgorithm,
+    getPrivateKey
+} = require('../../lib/tools');
 const { MessageParser } = require('./message-parser');
 const { dkimBody } = require('./body');
 const { generateCanonicalizedHeader } = require('./header');
@@ -194,10 +201,23 @@ class DkimSigner extends MessageParser {
                 continue;
             }
 
+            let privateKeyObj;
+
+            try {
+                privateKeyObj = getPrivateKey(signatureData.privateKey);
+            } catch (err) {
+                this.errors.push({
+                    selector: signatureData.selector,
+                    signingDomain: signatureData.signingDomain,
+                    err
+                });
+                continue;
+            }
+
             let hashKey = `${bodyCanon}:${hashAlgo}:${signatureData.maxBodyLength}`;
 
             try {
-                let keyType = crypto.createPrivateKey({ key: signatureData.privateKey, format: 'pem' }).asymmetricKeyType;
+                let keyType = privateKeyObj.asymmetricKeyType;
                 if (signAlgo && keyType !== signAlgo) {
                     // invalid key type
                     let err = new Error(`Invalid key type: "${keyType}" (expecting "${signAlgo}")`);
@@ -272,8 +292,8 @@ class DkimSigner extends MessageParser {
                     .sign(
                         // use `null` as algorithm to detect it from the key file
                         signAlgo === 'rsa' ? algorithm : null,
-                        canonicalizedHeader,
-                        signatureData.privateKey
+                        signAlgo === 'rsa' ? canonicalizedHeader : crypto.createHash('sha256').update(canonicalizedHeader).digest(),
+                        privateKeyObj
                     )
                     .toString('base64');
 

package/lib/dkim/dkim-verifier.js

@@ -230,7 +230,7 @@ class DkimVerifier extends MessageParser {
                         try {
                             status.result = crypto.verify(
                                 signatureHeader.signAlgo === 'rsa' ? signatureHeader.algorithm : null,
-                                canonicalizedHeader,
+                                signatureHeader.signAlgo === 'rsa' ? canonicalizedHeader : crypto.createHash('sha256').update(canonicalizedHeader).digest(),
                                 publicKey,
                                 Buffer.from(signatureHeader.parsed?.b?.value, 'base64')
                             )
@@ -338,7 +338,7 @@ class DkimVerifier extends MessageParser {
                     result.canonBodyLengthLimited = true;
                     result.canonBodyLengthLimit = signatureHeader.maxBodyLength;
                     if (result.canonBodyLengthTotal > result.canonBodyLength) {
-                        status.overSized = result.canonBodyLengthTotal - result.canonBodyLength;
+                        status.underSized = result.canonBodyLengthTotal - result.canonBodyLength;
                     }
                 } else {
                     result.canonBodyLengthLimited = false;

package/lib/dmarc/verify.js

@@ -102,7 +102,7 @@ const verifyDmarc = async opts => {
 
         alignment: {
             spf: { result: spfAlignment?.domain, strict: dmarcRecord.aspf === 's' },
-            dkim: { result: dkimAlignment?.domain, strict: dmarcRecord.adkim === 's', overSized: dkimAlignment?.overSized }
+            dkim: { result: dkimAlignment?.domain, strict: dmarcRecord.adkim === 's', underSized: dkimAlignment?.underSized }
         }
     });
 };

package/lib/mailauth.js

@@ -125,7 +125,7 @@ const authenticate = async (input, opts) => {
                     id: r.id,
                     domain: r.signingDomain,
                     aligned: r.status.aligned,
-                    overSized: r.status.overSized
+                    underSized: r.status.underSized
                 })),
             arcResult,
             resolver: opts.resolver

package/lib/tools.js

@@ -333,6 +333,28 @@ const getPublicKey = async (type, name, minBitLength, resolver) => {
     throw err;
 };
 
+const getPrivateKey = privateKeyBuf => {
+    let privateKeyOpts;
+
+    if (typeof privateKeyBuf === 'string') {
+        privateKeyBuf = Buffer.from(privateKeyBuf);
+    }
+
+    if (privateKeyBuf.length === 32) {
+        // seems like a raw ed25519 key
+        privateKeyBuf = Buffer.concat([Buffer.from('MC4CAQAwBQYDK2VwBCIEIA==', 'base64'), privateKeyBuf]);
+        privateKeyOpts = {
+            key: privateKeyBuf,
+            format: 'der',
+            type: 'pkcs8'
+        };
+    } else {
+        privateKeyOpts = { key: privateKeyBuf, format: 'pem' };
+    }
+
+    return crypto.createPrivateKey(privateKeyOpts);
+};
+
 const fetch = url =>
     new Promise((resolve, reject) => {
         https
@@ -398,8 +420,8 @@ const formatAuthHeaderRow = (method, status) => {
 
     parts.push(`${method}=${status.result || 'none'}`);
 
-    if (status.overSized) {
-        parts.push(`(${escapeCommentValue(`oversized signature ${status.overSized}B`)})`);
+    if (status.underSized) {
+        parts.push(`(${escapeCommentValue(`undersized signature: ${status.underSized} bytes unsigned`)})`);
     }
 
     if (status.comment) {
@@ -455,7 +477,7 @@ const getAlignment = (fromDomain, domainList, strict) => {
             }
             return entry;
         })
-        .sort((a, b) => (a.overSized || 0) - (b.overSized || 0));
+        .sort((a, b) => (a.underSized || 0) - (b.underSized || 0));
 
     if (strict) {
         fromDomain = formatDomain(fromDomain);
@@ -554,6 +576,7 @@ module.exports = {
     formatSignatureHeaderLine,
     parseDkimHeaders,
     getPublicKey,
+    getPrivateKey,
     formatAuthHeaderRow,
     escapeCommentValue,
     fetch,

package/man/mailauth.1

@@ -1,4 +1,4 @@
-.TH "MAILAUTH" "1" "January 2024" "v4.6.2" "Mailauth Help"
+.TH "MAILAUTH" "1" "February 2024" "v4.6.4" "Mailauth Help"
 .SH "NAME"
 \fBmailauth\fR
 .QP
@@ -138,7 +138,7 @@ You can split longer TXT strings into multiple strings\. There is no length limi
 Please report any bugs to https://github\.com/postalsys/mailauth/issues\.
 .SH LICENSE
 .P
-Copyright (c) 2020\-2022, Postal Systems (MIT)\.
+Copyright (c) 2020\-2024, Postal Systems (MIT)\.
 .SH SEE ALSO
 .P
 node\.js(1)

package/man/man.md

@@ -133,7 +133,7 @@ Please report any bugs to https://github.com/postalsys/mailauth/issues.
 
 ## LICENSE
 
-Copyright (c) 2020-2022, Postal Systems (MIT).
+Copyright (c) 2020-2024, Postal Systems (MIT).
 
 ## SEE ALSO
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailauth",
-    "version": "4.6.2",
+    "version": "4.6.4",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "scripts": {
@@ -43,16 +43,16 @@
         "marked-man": "0.7.0",
         "mbox-reader": "1.1.5",
         "mocha": "10.2.0",
-        "npm-check-updates": "16.14.12",
+        "npm-check-updates": "16.14.14",
         "pkg": "5.8.1"
     },
     "dependencies": {
-        "@postalsys/vmc": "1.0.6",
-        "fast-xml-parser": "4.3.3",
+        "@postalsys/vmc": "1.0.8",
+        "fast-xml-parser": "4.3.4",
         "ipaddr.js": "2.1.0",
-        "joi": "17.12.0",
+        "joi": "17.12.1",
         "libmime": "5.2.1",
-        "nodemailer": "6.9.8",
+        "nodemailer": "6.9.9",
         "psl": "1.9.0",
         "punycode": "2.3.1",
         "undici": "5.28.2",