src/PMG/DKIMSign.pm

   1 package PMG::DKIMSign;
   2
   3 use strict;
   4 use warnings;
   5 use Mail::DKIM::Signer;
   6 use Mail::DKIM::TextWrap;
   7 use Crypt::OpenSSL::RSA;
   8
   9 use PVE::Tools;
  10 use PVE::INotify;
  11 use PVE::SafeSyslog;
  12
  13 use PMG::Utils;
  14 use PMG::Config;
  15 use base qw(Mail::DKIM::Signer);
  16
  17 sub new {
  18     my ($class, $selector, $sign_all) = @_;
  19
  20     die "no selector provided\n" if ! $selector;
  21
  22     my %opts = (
  23         Algorithm => 'rsa-sha256',
  24         Method => 'relaxed/relaxed',
  25         Selector => $selector,
  26         KeyFile => "/etc/pmg/dkim/$selector.private",
  27     );
  28
  29     my $self = $class->SUPER::new(%opts);
  30
  31     $self->{sign_all} = $sign_all;
  32
  33     return $self;
  34 }
  35
  36 # MIME::Entity can output to all objects responding to 'print' (and does so in
  37 # chunks) Mail::DKIM::Signer has a 'PRINT' method and expects each line
  38 # terminated with "\r\n"
  39
  40
  41 sub print {
  42     my ($self, $chunk) = @_;
  43     $chunk =~ s/\012/\015\012/g;
  44     $self->PRINT($chunk);
  45 }
  46
  47 sub create_signature {
  48     my ($self) = @_;
  49
  50     $self->CLOSE();
  51     return $self->signature->as_string();
  52 }
  53
  54 #determines which domain should be used for signing based on the e-mailaddress
  55 sub signing_domain {
  56     my ($self, $sender_email) = @_;
  57
  58     my @parts = split('@', $sender_email);
  59     die "no domain in sender e-mail\n" if scalar(@parts) < 2;
  60     my $input_domain = $parts[-1];
  61
  62     if ($self->{sign_all}) {
  63             $self->domain($input_domain) if $self->{sign_all};
  64             return 1;
  65     }
  66
  67     # check that input_domain is in/a subdomain of in the
  68     # dkimdomains, falling back to the relay domains.
  69     my $dkimdomains = PVE::INotify::read_file('dkimdomains');
  70     $dkimdomains = PVE::INotify::read_file('domains') if !scalar(%$dkimdomains);
  71
  72     foreach my $domain (sort keys %$dkimdomains) {
  73         if ( $input_domain =~ /\Q$domain\E$/i ) {
  74             $self->domain($domain);
  75             return 1;
  76         }
  77     }
  78
  79     syslog('info', "not DKIM signing mail from $sender_email");
  80
  81     return 0;
  82 }
  83
  84
  85 sub sign_entity {
  86     my ($entity, $selector, $sender, $sign_all) = @_;
  87
  88     die "no selector provided\n" if ! $selector;
  89
  90     #oversign certain headers
  91     my @oversign_headers = (
  92         'from',
  93         'to',
  94         'cc',
  95         'reply-to',
  96         'subject',
  97     );
  98
  99     my @cond_headers = (
 100         'content-type',
 101     );
 102
 103     push(@oversign_headers, grep { $entity->head->mime_attr($_) } @cond_headers);
 104
 105     my $extended_headers = { map { $_ => '+' } @oversign_headers };
 106
 107     my $signer = __PACKAGE__->new($selector, $sign_all);
 108
 109     $signer->extended_headers($extended_headers);
 110
 111     if ($signer->signing_domain($sender)) {
 112         $entity->print($signer);
 113         my $signature = $signer->create_signature();
 114         $entity->head->add('DKIM-Signature', $signature, 0);
 115     }
 116
 117     return $entity;
 118
 119 }
 120
 121 # key-handling and utility methods
 122 sub get_selector_info {
 123     my ($selector) = @_;
 124
 125     die "no selector provided\n" if !defined($selector);
 126     my ($pubkey, $size);
 127     eval {
 128         my $privkeytext = PVE::Tools::file_get_contents("/etc/pmg/dkim/$selector.private");
 129         my $privkey =  Crypt::OpenSSL::RSA->new_private_key($privkeytext);
 130         $size = $privkey->size() * 8;
 131
 132         $pubkey = $privkey->get_public_key_x509_string();
 133     };
 134     die "$@\n" if $@;
 135
 136     $pubkey =~ s/-----(?:BEGIN|END) PUBLIC KEY-----//g;
 137     $pubkey =~ s/\v//mg;
 138
 139     # split record into 250 byte chunks for DNS-server compatibility
 140     # see opendkim-genkey
 141     my $record = qq{$selector._domainkey\tIN\tTXT\t( "v=DKIM1; h=sha256; k=rsa; "\n\t  "p=};
 142     my $len = length($pubkey);
 143     my $cur = 0;
 144     while ($len > 0) {
 145         if ($len < 250) {
 146             $record .= substr($pubkey, $cur);
 147             $len = 0;
 148         } else {
 149             $record .= substr($pubkey, $cur, 250) . qq{"\n\t  "};
 150             $cur += 250;
 151             $len -= 250;
 152         }
 153     }
 154     $record .= qq{" )  ; ----- DKIM key $selector};
 155
 156     return ($record, $size);
 157 }
 158
 159 sub set_selector {
 160     my ($selector, $keysize) = @_;
 161
 162     die "no selector provided\n" if !defined($selector);
 163     die "no keysize provided\n" if !defined($keysize);
 164     die "invalid keysize\n" if ($keysize < 1024);
 165     my $privkey_file = "/etc/pmg/dkim/$selector.private";
 166
 167     my $code = sub{
 168         my $cmd = ['openssl', 'genrsa', '-out', $privkey_file, $keysize];
 169         PMG::Utils::run_silent_cmd($cmd);
 170         my $cfg = PMG::Config->new();
 171         $cfg->set('admin', 'dkim_selector', $selector);
 172         $cfg->write();
 173         PMG::Utils::reload_smtp_filter();
 174     };
 175
 176     PMG::Config::lock_config($code, "unable to generate DKIM key ($selector - $keysize bits)");
 177 }
 178 1;