A. Schulze
3e57876361
added after an existing DKIM signing application to add an Ed25519 signature (Thanks to A. Schulze for the patch)
298 lines
11 KiB
Python
298 lines
11 KiB
Python
#! /usr/bin/python2
|
|
# Original dkim-milter.py code:
|
|
# Author: Stuart D. Gathman <stuart@bmsi.com>
|
|
# Copyright 2007 Business Management Systems, Inc.
|
|
# This code is under GPL. See COPYING for details.
|
|
|
|
# dkimpy-milter: A DKIM signing/verification Milter application
|
|
# Author: Scott Kitterman <scott@kitterman.com>
|
|
# Copyright 2018 Scott Kitterman
|
|
""" This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 2 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License along
|
|
with this program; if not, write to the Free Software Foundation, Inc.,
|
|
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA."""
|
|
|
|
import sys
|
|
import syslog
|
|
import Milter
|
|
import dkim
|
|
from dkim.dnsplug import get_txt
|
|
from dkim.util import parse_tag_value
|
|
import authres
|
|
import os
|
|
import tempfile
|
|
import StringIO
|
|
import re
|
|
from Milter.config import MilterConfigParser
|
|
from Milter.utils import iniplist,parse_addr,parseaddr
|
|
import dkimpy_milter.config as config
|
|
from dkimpy_milter.util import drop_privileges
|
|
from dkimpy_milter.util import setExceptHook
|
|
from dkimpy_milter.util import write_pid
|
|
from dkimpy_milter.util import read_keyfile
|
|
from dkimpy_milter.util import own_socketfile
|
|
from dkimpy_milter.util import fold
|
|
|
|
__version__ = "0.9.4"
|
|
FWS = re.compile(r'\r?\n[ \t]+')
|
|
|
|
class dkimMilter(Milter.Base):
|
|
"Milter to check and sign DKIM. Each connection gets its own instance."
|
|
|
|
def __init__(self):
|
|
self.mailfrom = None
|
|
self.id = Milter.uniqueID()
|
|
# we don't want config used to change during a connection
|
|
self.conf = milterconfig
|
|
self.privatersa = privateRSA
|
|
self.privateed25519 = privateEd25519
|
|
self.fp = None
|
|
|
|
@Milter.noreply
|
|
def connect(self,hostname,unused,hostaddr):
|
|
self.internal_connection = False
|
|
self.hello_name = None
|
|
# sometimes people put extra space in sendmail config, so we strip
|
|
self.receiver = self.getsymval('j').strip()
|
|
if hostaddr and len(hostaddr) > 0:
|
|
ipaddr = hostaddr[0]
|
|
"""if iniplist(ipaddr,self.conf.internal_connect): FIXME
|
|
self.internal_connection = True"""
|
|
else: ipaddr = ''
|
|
self.connectip = ipaddr
|
|
if self.internal_connection:
|
|
connecttype = 'INTERNAL'
|
|
else:
|
|
connecttype = 'EXTERNAL'
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog("connect from {0} at {1} {2}".format(hostname,hostaddr,connecttype))
|
|
return Milter.CONTINUE
|
|
|
|
# multiple messages can be received on a single connection
|
|
# envfrom (MAIL FROM in the SMTP protocol) seems to mark the start
|
|
# of each message.
|
|
@Milter.noreply
|
|
def envfrom(self,f,*str):
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog("mail from: {0} {1}".format(f,str))
|
|
self.fp = StringIO.StringIO()
|
|
self.mailfrom = f
|
|
t = parse_addr(f)
|
|
if len(t) == 2: t[1] = t[1].lower()
|
|
self.canon_from = '@'.join(t)
|
|
self.user = self.getsymval('{auth_authen}')
|
|
self.has_dkim = 0
|
|
self.author = None
|
|
self.arheaders = []
|
|
self.arresults = []
|
|
'''if self.user:
|
|
# Very simple SMTP AUTH policy by default:
|
|
# any successful authentication is considered INTERNAL
|
|
self.internal_connection = True
|
|
auth_type = self.getsymval('{auth_type}')
|
|
ssl_bits = self.getsymval('{cipher_bits}')
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog(
|
|
"SMTP AUTH:",self.user,"sslbits =",ssl_bits, auth_type,
|
|
"ssf =",self.getsymval('{auth_ssf}'), "INTERNAL"
|
|
)
|
|
# Detailed authorization policy is configured in the access file below.
|
|
self.arresults.append(
|
|
authres.SMTPAUTHAuthenticationResult(result = 'pass',
|
|
result_comment = auth_type+' sslbits='+ssl_bits, smtp_auth = self.user)
|
|
)'''
|
|
return Milter.CONTINUE
|
|
|
|
@Milter.noreply
|
|
def header(self,name,val):
|
|
lname = name.lower()
|
|
if lname == 'dkim-signature':
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog("{0}: {1}".format(name,val))
|
|
self.has_dkim += 1
|
|
if lname == 'from':
|
|
fname,self.author = parseaddr(val)
|
|
self.fdomain = self.author.split('@')[1]
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog("{0}: {1}".format(name,val))
|
|
elif lname == 'authentication-results':
|
|
self.arheaders.append(val)
|
|
if self.fp:
|
|
self.fp.write("%s: %s\n" % (name,val))
|
|
return Milter.CONTINUE
|
|
|
|
@Milter.noreply
|
|
def eoh(self):
|
|
if self.fp:
|
|
self.fp.write("\n") # terminate headers
|
|
self.bodysize = 0
|
|
return Milter.CONTINUE
|
|
|
|
@Milter.noreply
|
|
def body(self,chunk): # copy body to temp file
|
|
if self.fp:
|
|
self.fp.write(chunk) # IOError causes TEMPFAIL in milter
|
|
self.bodysize += len(chunk)
|
|
return Milter.CONTINUE
|
|
|
|
def eom(self):
|
|
if not self.fp:
|
|
return Milter.ACCEPT # no message collected - so no eom processing
|
|
# Remove existing Authentication-Results headers for our authserv_id
|
|
for i,val in enumerate(self.arheaders,1):
|
|
# FIXME: don't delete A-R headers from trusted MTAs
|
|
try:
|
|
ar = authres.AuthenticationResultsHeader.parse_value(FWS.sub('',val))
|
|
if ar.authserv_id == self.receiver:
|
|
self.chgheader('authentication-results',i,'')
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog('REMOVE: {0}'.format(val))
|
|
except:
|
|
# Don't error out on unparseable AR header fiels
|
|
pass
|
|
# Check or sign DKIM
|
|
self.fp.seek(0)
|
|
if milterconfig.get('Domain'):
|
|
domain = milterconfig.get('Domain')
|
|
else:
|
|
domain = ''
|
|
if (self.fdomain in domain) and (not milterconfig.get('Mode') == 'v'):
|
|
txt = self.fp.read()
|
|
self.sign_dkim(txt)
|
|
result = None
|
|
if (self.has_dkim) and (not self.internal_connection) and (milterconfig.get('Mode') == 'v' or milterconfig.get('Mode') == 'sv'):
|
|
txt = self.fp.read()
|
|
self.check_dkim(txt)
|
|
else:
|
|
result = 'none'
|
|
if self.arresults:
|
|
h = authres.AuthenticationResultsHeader(authserv_id = self.receiver,
|
|
results=self.arresults)
|
|
h = fold(str(h))
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog(str(h))
|
|
name,val = str(h).split(': ',1)
|
|
self.addheader(name,val,0)
|
|
return Milter.CONTINUE
|
|
|
|
def sign_dkim(self,txt):
|
|
canon = milterconfig.get('Canonicalization')
|
|
canonicalize = []
|
|
if len(canon.split('/')) == 2:
|
|
canonicalize.append(canon.split('/')[0])
|
|
canonicalize.append(canon.split('/')[1])
|
|
else:
|
|
canonicalize.append(canon)
|
|
canonicalize.append(canon)
|
|
syslog.syslog('canonicalize: {0}'.format(canonicalize))
|
|
try:
|
|
if privateRSA:
|
|
d = dkim.DKIM(txt)
|
|
h = d.sign(milterconfig.get('Selector'), self.fdomain, privateRSA,
|
|
canonicalize=(canonicalize[0], canonicalize[1]))
|
|
name,val = h.split(': ',1)
|
|
self.addheader(name,val.strip().replace('\r\n','\n'),0)
|
|
if privateEd25519:
|
|
d = dkim.DKIM(txt)
|
|
h = d.sign(milterconfig.get('SelectorEd25519'), self.fdomain, privateEd25519,
|
|
canonicalize=(canonicalize[0], canonicalize[1]), signature_algorithm='ed25519-sha256')
|
|
name,val = h.split(': ',1)
|
|
self.addheader(name,val.strip().replace('\r\n','\n'),0)
|
|
except dkim.DKIMException as x:
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog('DKIM: {0}'.format(x))
|
|
except Exception as x:
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog("sign_dkim: {0}".format(x))
|
|
raise
|
|
|
|
def check_dkim(self,txt):
|
|
res = False
|
|
conf = self.conf
|
|
for y in range(self.has_dkim): # Verify _ALL_ the signatures
|
|
d = dkim.DKIM(txt)
|
|
try:
|
|
res = d.verify(idx=y)
|
|
if res:
|
|
self.dkim_comment = 'Good {0} bit {1} signature.'.format(d.keysize, d.signature_fields.get(b'a'))
|
|
else:
|
|
self.dkim_comment = 'Bad {0} bit {1} signature.'.format(d.keysize, d.signature_fields.get(b'a'))
|
|
except dkim.DKIMException as x:
|
|
self.dkim_comment = str(x)
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog('DKIM: {0}'.format(x))
|
|
except Exception as x:
|
|
self.dkim_comment = str(x)
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog("check_dkim: {0}".format(x))
|
|
self.header_i = d.signature_fields.get(b'i')
|
|
self.header_d = d.signature_fields.get(b'd')
|
|
self.header_a = d.signature_fields.get(b'a')
|
|
if res:
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog('DKIM: Pass ({0})'.format(d.domain))
|
|
self.dkim_domain = d.domain
|
|
else:
|
|
fd,fname = tempfile.mkstemp(".dkim")
|
|
with os.fdopen(fd,"w+b") as fp:
|
|
fp.write(txt)
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog('DKIM: Fail (saved as {0})'.format(fname))
|
|
if res:
|
|
result = 'pass'
|
|
else:
|
|
result = 'fail'
|
|
res = False
|
|
self.arresults.append(
|
|
authres.DKIMAuthenticationResult(result=result,
|
|
header_i = self.header_i, header_d = self.header_d, header_a = self.header_a,
|
|
result_comment = self.dkim_comment)
|
|
)
|
|
return
|
|
|
|
def main():
|
|
# Ugh, but there's no easy way around this.
|
|
global milterconfig
|
|
global privateRSA
|
|
global privateEd25519
|
|
privateRSA = False
|
|
privateEd25519 = False
|
|
configFile = '/etc/dkimpy-milter.conf'
|
|
if len(sys.argv) > 1:
|
|
if sys.argv[1] in ( '-?', '--help', '-h' ):
|
|
print('usage: dkimpy-milter [<configfilename>]')
|
|
sys.exit(1)
|
|
configFile = sys.argv[1]
|
|
milterconfig = config._processConfigFile(filename = configFile)
|
|
if milterconfig.get('Syslog'):
|
|
facility = eval("syslog.LOG_{0}".format(milterconfig.get('SyslogFacility').upper()))
|
|
syslog.openlog(os.path.basename(sys.argv[0]), syslog.LOG_PID, facility)
|
|
setExceptHook()
|
|
pid = write_pid(milterconfig)
|
|
if milterconfig.get('KeyFile'):
|
|
privateRSA = read_keyfile(milterconfig, 'RSA')
|
|
if milterconfig.get('KeyFileEd25519'):
|
|
privateEd25519 = read_keyfile(milterconfig, 'Ed25519')
|
|
Milter.factory = dkimMilter
|
|
Milter.set_flags(Milter.CHGHDRS + Milter.ADDHDRS)
|
|
miltername = 'dkimpy-filter'
|
|
socketname = milterconfig.get('Socket')
|
|
if milterconfig.get('Syslog'):
|
|
syslog.syslog('dkimpy-milter started:{0} user:{1}'.format(pid,milterconfig.get('UserID')))
|
|
sys.stdout.flush()
|
|
Milter.runmilter(miltername,socketname,240)
|
|
own_socketfile(milterconfig)
|
|
drop_privileges(milterconfig)
|
|
|
|
if __name__ == "__main__":
|
|
main()
|