mailauth 4.6.3 → 4.6.5

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [4.6.5](https://github.com/postalsys/mailauth/compare/v4.6.4...v4.6.5) (2024-02-12)
+
+
+### Bug Fixes
+
+* **dkim:** Added new output property mimeStructureStart ([8f25353](https://github.com/postalsys/mailauth/commit/8f25353fa6a67ba3e1f0c5091325007b2434a29d))
+
+## [4.6.4](https://github.com/postalsys/mailauth/compare/v4.6.3...v4.6.4) (2024-02-05)
+
+
+### Bug Fixes
+
+* **ed25519:** Fixed ed25519 signing and verification ([40f1245](https://github.com/postalsys/mailauth/commit/40f12457d8f49f0ea21015fe4203b4de746ab7b8))
+
 ## [4.6.3](https://github.com/postalsys/mailauth/compare/v4.6.2...v4.6.3) (2024-01-26)
 
 

package/lib/arc/index.js

@@ -146,7 +146,7 @@ const signAS = async (chain, entry, signatureData) => {
         .sign(
             // use `null` as algorithm to detect it from the key file
             signAlgo === 'rsa' ? algorithm : null,
-            canonicalizedHeader,
+            signAlgo === 'rsa' ? canonicalizedHeader : crypto.createHash('sha256').update(canonicalizedHeader).digest(),
             privateKey
         )
         .toString('base64');

package/lib/dkim/body/relaxed.js

@@ -3,6 +3,7 @@
 'use strict';
 
 const crypto = require('crypto');
+const { MimeStructureStartFinder } = require('../mime-structure-start-finder');
 
 const CHAR_CR = 0x0d;
 const CHAR_LF = 0x0a;
@@ -39,9 +40,20 @@ class RelaxedHash {
         this.maxSizeReached = maxBodyLength === 0;
 
         this.emptyLinesQueue = [];
+
+        this.mimeStructureStartFinder = new MimeStructureStartFinder();
+    }
+
+    setContentType(contentTypeObj) {
+        if (/^multipart\//i.test(contentTypeObj.value) && contentTypeObj.params.boundary) {
+            this.mimeStructureStartFinder.setBoundary(contentTypeObj.params.boundary);
+        }
     }
 
     _updateBodyHash(chunk) {
+        // serach through the entire document, not just signed part
+        this.mimeStructureStartFinder.update(chunk);
+
         this.canonicalizedLength += chunk.length;
 
         if (this.maxSizeReached) {
@@ -270,6 +282,10 @@ class RelaxedHash {
         // finalize
         return this.bodyHash.digest(encoding);
     }
+
+    getMimeStructureStart() {
+        return this.mimeStructureStartFinder.getMimeStructureStart();
+    }
 }
 
 module.exports = { RelaxedHash };

package/lib/dkim/body/simple.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const crypto = require('crypto');
+const { MimeStructureStartFinder } = require('../mime-structure-start-finder');
 
 /**
  * Class for calculating body hash of an email message body stream
@@ -30,9 +31,20 @@ class SimpleHash {
         this.maxSizeReached = maxBodyLength === 0;
 
         this.lastNewline = false;
+
+        this.mimeStructureStartFinder = new MimeStructureStartFinder();
+    }
+
+    setContentType(contentTypeObj) {
+        if (/^multipart\//i.test(contentTypeObj.value) && contentTypeObj.params.boundary) {
+            this.mimeStructureStartFinder.setBoundary(contentTypeObj.params.boundary);
+        }
     }
 
     _updateBodyHash(chunk) {
+        // serach through the entire document, not just signed part
+        this.mimeStructureStartFinder.update(chunk);
+
         this.canonicalizedLength += chunk.length;
 
         if (this.maxSizeReached) {
@@ -115,6 +127,10 @@ class SimpleHash {
 
         return this.bodyHash.digest(encoding);
     }
+
+    getMimeStructureStart() {
+        return this.mimeStructureStartFinder.getMimeStructureStart();
+    }
 }
 
 module.exports = { SimpleHash };

package/lib/dkim/dkim-signer.js

@@ -1,6 +1,13 @@
 'use strict';
 
-const { getSigningHeaderLines, formatSignatureHeaderLine, defaultDKIMFieldNames, defaultARCFieldNames, validateAlgorithm } = require('../../lib/tools');
+const {
+    getSigningHeaderLines,
+    formatSignatureHeaderLine,
+    defaultDKIMFieldNames,
+    defaultARCFieldNames,
+    validateAlgorithm,
+    getPrivateKey
+} = require('../../lib/tools');
 const { MessageParser } = require('./message-parser');
 const { dkimBody } = require('./body');
 const { generateCanonicalizedHeader } = require('./header');
@@ -194,10 +201,23 @@ class DkimSigner extends MessageParser {
                 continue;
             }
 
+            let privateKeyObj;
+
+            try {
+                privateKeyObj = getPrivateKey(signatureData.privateKey);
+            } catch (err) {
+                this.errors.push({
+                    selector: signatureData.selector,
+                    signingDomain: signatureData.signingDomain,
+                    err
+                });
+                continue;
+            }
+
             let hashKey = `${bodyCanon}:${hashAlgo}:${signatureData.maxBodyLength}`;
 
             try {
-                let keyType = crypto.createPrivateKey({ key: signatureData.privateKey, format: 'pem' }).asymmetricKeyType;
+                let keyType = privateKeyObj.asymmetricKeyType;
                 if (signAlgo && keyType !== signAlgo) {
                     // invalid key type
                     let err = new Error(`Invalid key type: "${keyType}" (expecting "${signAlgo}")`);
@@ -272,8 +292,8 @@ class DkimSigner extends MessageParser {
                     .sign(
                         // use `null` as algorithm to detect it from the key file
                         signAlgo === 'rsa' ? algorithm : null,
-                        canonicalizedHeader,
-                        signatureData.privateKey
+                        signAlgo === 'rsa' ? canonicalizedHeader : crypto.createHash('sha256').update(canonicalizedHeader).digest(),
+                        privateKeyObj
                     )
                     .toString('base64');
 

package/lib/dkim/dkim-verifier.js

@@ -8,6 +8,7 @@ const { getARChain } = require('../arc');
 const addressparser = require('nodemailer/lib/addressparser');
 const crypto = require('crypto');
 const { v4: uuidv4 } = require('uuid');
+const libmime = require('libmime');
 
 class DkimVerifier extends MessageParser {
     constructor(options) {
@@ -147,6 +148,23 @@ class DkimVerifier extends MessageParser {
             if (!this.bodyHashes.has(signatureHeader.bodyHashKey)) {
                 this.bodyHashes.set(signatureHeader.bodyHashKey, dkimBody(signatureHeader.bodyCanon, signatureHeader.hashAlgo, signatureHeader.maxBodyLength));
             }
+
+            let headersArray = this.headers.parsed;
+            const findLastMethod = typeof headersArray.findLast === 'function' ? headersArray.findLast : headersArray.find;
+            if (typeof headersArray.findLast !== 'function') {
+                headersArray = [].concat(headersArray).reverse();
+            }
+            const contentTypeHeader = findLastMethod.call(headersArray, header => header.key === 'content-type');
+            if (contentTypeHeader) {
+                let line = contentTypeHeader.line.toString();
+                if (line.indexOf(':') >= 0) {
+                    line = line.substring(line.indexOf(':') + 1).trim();
+                }
+                const parsedContentType = libmime.parseHeaderValue(line);
+                for (let hasher of this.bodyHashes.values()) {
+                    hasher.setContentType(parsedContentType);
+                }
+            }
         }
     }
 
@@ -165,6 +183,7 @@ class DkimVerifier extends MessageParser {
             // convert bodyHashes from hash objects to base64 strings
             for (let [key, bodyHash] of this.bodyHashes.entries()) {
                 this.bodyHashes.get(key).hash = bodyHash.digest('base64');
+                this.bodyHashes.get(key).mimeStructureStart = bodyHash.getMimeStructureStart();
             }
 
             for (let signatureHeader of this.signatureHeaders) {
@@ -210,7 +229,9 @@ class DkimVerifier extends MessageParser {
                         : false;
                 }
 
-                let bodyHash = this.bodyHashes.get(signatureHeader.bodyHashKey)?.hash;
+                const bodyHash = this.bodyHashes.get(signatureHeader.bodyHashKey)?.hash;
+                const mimeStructureStart = this.bodyHashes.get(signatureHeader.bodyHashKey)?.mimeStructureStart;
+
                 if (signatureHeader.parsed?.bh?.value !== bodyHash) {
                     status.result = 'neutral';
                     status.comment = `body hash did not verify`;
@@ -230,7 +251,7 @@ class DkimVerifier extends MessageParser {
                         try {
                             status.result = crypto.verify(
                                 signatureHeader.signAlgo === 'rsa' ? signatureHeader.algorithm : null,
-                                canonicalizedHeader,
+                                signatureHeader.signAlgo === 'rsa' ? canonicalizedHeader : crypto.createHash('sha256').update(canonicalizedHeader).digest(),
                                 publicKey,
                                 Buffer.from(signatureHeader.parsed?.b?.value, 'base64')
                             )
@@ -344,6 +365,10 @@ class DkimVerifier extends MessageParser {
                     result.canonBodyLengthLimited = false;
                 }
 
+                if (typeof mimeStructureStart === 'number') {
+                    result.mimeStructureStart = mimeStructureStart;
+                }
+
                 if (publicKey) {
                     result.publicKey = publicKey.toString();
                 }

package/lib/dkim/mime-structure-start-finder.js

@@ -0,0 +1,85 @@
+'use strict';
+
+class MimeStructureStartFinder {
+    constructor() {
+        this.byteCache = [];
+
+        this.matchFound = false;
+        this.noMatch = false;
+        this.lineStart = -1;
+
+        this.prevChunks = 0;
+
+        this.mimeStructureStart = -1;
+    }
+
+    setBoundary(boundary) {
+        this.boundary = (boundary || '').toString().trim();
+
+        this.boundaryBuf = Array.from(Buffer.from(`--${this.boundary}`));
+        this.boundaryBufLen = this.boundaryBuf.length;
+    }
+
+    update(chunk) {
+        if (this.matchFound || !this.boundary) {
+            return;
+        }
+
+        for (let i = 0, bufLen = chunk.length; i < bufLen; i++) {
+            let c = chunk[i];
+
+            // check ending
+            if (c === 0x0a || c === 0x0d) {
+                if (!this.noMatch && this.byteCache.length === this.boundaryBufLen) {
+                    // match found
+                    this.matchFound = true;
+                    this.mimeStructureStart = this.lineStart;
+                    break;
+                }
+                // reset counter
+                this.lineStart = -1;
+                this.noMatch = false;
+                this.byteCache = [];
+                continue;
+            }
+
+            if (this.noMatch) {
+                // no need to look
+                continue;
+            }
+
+            if (this.lineStart < 0) {
+                this.lineStart = this.prevChunks + i;
+            }
+
+            if (this.byteCache.length >= this.boundaryBufLen) {
+                this.noMatch = true;
+                continue;
+            }
+
+            const expectingByte = this.boundaryBuf[this.byteCache.length];
+            if (expectingByte !== c) {
+                this.noMatch = true;
+                continue;
+            }
+            this.byteCache[this.byteCache.length] = c;
+        }
+
+        this.prevChunks += chunk.length;
+    }
+
+    getMimeStructureStart() {
+        if (!this.boundary) {
+            return 0;
+        }
+
+        if (!this.matchFound && !this.noMatch && this.byteCache.length === this.boundaryBufLen) {
+            this.matchFound = true;
+            this.mimeStructureStart = this.lineStart;
+        }
+
+        return this.mimeStructureStart;
+    }
+}
+
+module.exports = { MimeStructureStartFinder };

package/lib/tools.js

@@ -333,6 +333,28 @@ const getPublicKey = async (type, name, minBitLength, resolver) => {
     throw err;
 };
 
+const getPrivateKey = privateKeyBuf => {
+    let privateKeyOpts;
+
+    if (typeof privateKeyBuf === 'string') {
+        privateKeyBuf = Buffer.from(privateKeyBuf);
+    }
+
+    if (privateKeyBuf.length === 32) {
+        // seems like a raw ed25519 key
+        privateKeyBuf = Buffer.concat([Buffer.from('MC4CAQAwBQYDK2VwBCIEIA==', 'base64'), privateKeyBuf]);
+        privateKeyOpts = {
+            key: privateKeyBuf,
+            format: 'der',
+            type: 'pkcs8'
+        };
+    } else {
+        privateKeyOpts = { key: privateKeyBuf, format: 'pem' };
+    }
+
+    return crypto.createPrivateKey(privateKeyOpts);
+};
+
 const fetch = url =>
     new Promise((resolve, reject) => {
         https
@@ -399,7 +421,7 @@ const formatAuthHeaderRow = (method, status) => {
     parts.push(`${method}=${status.result || 'none'}`);
 
     if (status.underSized) {
-        parts.push(`(${escapeCommentValue(`undersized signature: ${status.underSized}`)})`);
+        parts.push(`(${escapeCommentValue(`undersized signature: ${status.underSized} bytes unsigned`)})`);
     }
 
     if (status.comment) {
@@ -554,6 +576,7 @@ module.exports = {
     formatSignatureHeaderLine,
     parseDkimHeaders,
     getPublicKey,
+    getPrivateKey,
     formatAuthHeaderRow,
     escapeCommentValue,
     fetch,

package/man/mailauth.1

@@ -1,4 +1,4 @@
-.TH "MAILAUTH" "1" "January 2024" "v4.6.3" "Mailauth Help"
+.TH "MAILAUTH" "1" "February 2024" "v4.6.5" "Mailauth Help"
 .SH "NAME"
 \fBmailauth\fR
 .QP

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailauth",
-    "version": "4.6.3",
+    "version": "4.6.5",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "scripts": {
@@ -43,16 +43,16 @@
         "marked-man": "0.7.0",
         "mbox-reader": "1.1.5",
         "mocha": "10.2.0",
-        "npm-check-updates": "16.14.13",
+        "npm-check-updates": "16.14.14",
         "pkg": "5.8.1"
     },
     "dependencies": {
-        "@postalsys/vmc": "1.0.6",
-        "fast-xml-parser": "4.3.3",
+        "@postalsys/vmc": "1.0.8",
+        "fast-xml-parser": "4.3.4",
         "ipaddr.js": "2.1.0",
-        "joi": "17.12.0",
+        "joi": "17.12.1",
         "libmime": "5.2.1",
-        "nodemailer": "6.9.8",
+        "nodemailer": "6.9.9",
         "psl": "1.9.0",
         "punycode": "2.3.1",
         "undici": "5.28.2",