From 1196ed6760cd6f9baab63de4edbb71aec3395329 Mon Sep 17 00:00:00 2001 From: "Stuart D. Gathman" Date: Mon, 23 Apr 2012 19:02:29 -0400 Subject: [PATCH] Test case for FWS in b= tag not ignored on verify. --- dkim/__init__.py | 2 ++ dkim/tests/test_dkim.py | 14 +++++++++++--- packaging/pydkim.spec | 1 + 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/dkim/__init__.py b/dkim/__init__.py index 7183421..e912218 100644 --- a/dkim/__init__.py +++ b/dkim/__init__.py @@ -455,6 +455,8 @@ class DKIM(object): sig2 = RSASSA_PKCS1_v1_5_sign(h, pk) except DigestTooLargeError: raise ParameterError("digest too large for modulus") + # Folding b= is explicity allowed, but yahoo and live.com are broken + #sig_value = fold(sig_value + base64.b64encode(bytes(sig2))) sig_value += base64.b64encode(bytes(sig2)) self.domain = domain diff --git a/dkim/tests/test_dkim.py b/dkim/tests/test_dkim.py index 1fbd0e9..5805bf2 100644 --- a/dkim/tests/test_dkim.py +++ b/dkim/tests/test_dkim.py @@ -86,9 +86,12 @@ class TestSignAndVerify(unittest.TestCase): res = dkim.verify(sig + self.message, dnsfunc=self.dnsfunc) self.assertFalse(res) - def test_dkim_dignature_canonicalization(self): + def test_dkim_signature_canonicalization(self): # # Relaxed-mode header signing is wrong + # + # Simple-mode signature header verification is wrong + # (should ignore FWS anywhere in signature tag: b=) sample_msg = """\ From: mbp@canonical.com To: scottk@example.com @@ -125,8 +128,13 @@ b/mPfjC0QJTocVBq6Za/PlzfV+Py92VaCak19F4WrbVTK5Gg5tW220MCAwEAAQ==""" dkim_header = dkim.sign(sample_msg, 'example', 'canonical.com', sample_privkey, canonicalize=(header_mode, dkim.Relaxed)) - signed = dkim_header + sample_msg - + # Folding dkim_header affects b= tag only, since dkim.sign folds + # sig_value with empty b= before hashing, and then appends the + # signature. So folding dkim_header again adds FWS to + # the b= tag only. This should be ignored even with + # simple canonicalization. + # http://tools.ietf.org/html/rfc4871#section-3.5 + signed = dkim.fold(dkim_header) + sample_msg result = dkim.verify(signed,dnsfunc=lambda x: _dns_responses[x]) self.assertTrue(result) diff --git a/packaging/pydkim.spec b/packaging/pydkim.spec index e8eb777..999122e 100644 --- a/packaging/pydkim.spec +++ b/packaging/pydkim.spec @@ -48,6 +48,7 @@ rm -rf $RPM_BUILD_ROOT - Fix sha1 hash, Bug #969206 - Fix NoAnswer exception using dnspython - Fix typos reporting ValidationError and DKIMException +- Change default canonicalization to relaxed/simple to work around Bug #939128 * Fri Feb 03 2012 Stuart Gathman 0.5.1-1 - performance patch from https://launchpad.net/~petri Petri Lehtinen