Skip to content

Commit 4b475ed

Browse files
fabpotfabpot
committed
[Mime] Add DKIM support
1 parent c0831f9 commit 4b475ed

File tree

5 files changed

+478
-1
lines changed

5 files changed

+478
-1
lines changed

‎src/Symfony/Component/Mime/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ CHANGELOG
44
5.2.0
55
-----
66

7+
* Add support for DKIM
78
* Deprecated `Address::fromString()`, use `Address::create()` instead
89

910
4.4.0

‎src/Symfony/Component/Mime/Crypto/DkimOptions.php

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Mime\Crypto;
13+
14+
/**
15+
* A helper providing autocompletion for available DkimSigner options.
16+
*
17+
* @author Fabien Potencier <fabien@symfony.com>
18+
*/
19+
final class DkimOptions
20+
{
21+
private $options = [];
22+
23+
public function toArray(): array
24+
{
25+
return $this->options;
26+
}
27+
28+
/**
29+
* @return $this
30+
*/
31+
public function algorithm(int $algo): self
32+
{
33+
$this->options['algorithm'] = $algo;
34+
35+
return $this;
36+
}
37+
38+
/**
39+
* @return $this
40+
*/
41+
public function signatureExpirationDelay(int $show): self
42+
{
43+
$this->options['signature_expiration_delay'] = $show;
44+
45+
return $this;
46+
}
47+
48+
/**
49+
* @return $this
50+
*/
51+
public function bodyMaxLength(int $max): self
52+
{
53+
$this->options['body_max_length'] = $max;
54+
55+
return $this;
56+
}
57+
58+
/**
59+
* @return $this
60+
*/
61+
public function bodyShowLength(bool $show): self
62+
{
63+
$this->options['body_show_length'] = $show;
64+
65+
return $this;
66+
}
67+
68+
/**
69+
* @return $this
70+
*/
71+
public function headerCanon(string $canon): self
72+
{
73+
$this->options['header_canon'] = $canon;
74+
75+
return $this;
76+
}
77+
78+
/**
79+
* @return $this
80+
*/
81+
public function bodyCanon(string $canon): self
82+
{
83+
$this->options['body_canon'] = $canon;
84+
85+
return $this;
86+
}
87+
88+
/**
89+
* @return $this
90+
*/
91+
public function headersToIgnore(array $headers): self
92+
{
93+
$this->options['headers_to_ignore'] = $headers;
94+
95+
return $this;
96+
}
97+
}

‎src/Symfony/Component/Mime/Crypto/DkimSigner.php

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Mime\Crypto;
13+
14+
use Symfony\Component\Mime\Exception\InvalidArgumentException;
15+
use Symfony\Component\Mime\Exception\RuntimeException;
16+
use Symfony\Component\Mime\Header\UnstructuredHeader;
17+
use Symfony\Component\Mime\Message;
18+
use Symfony\Component\Mime\Part\AbstractPart;
19+
20+
/**
21+
* @author Fabien Potencier <fabien@symfony.com>
22+
*
23+
* RFC 6376 and 8301
24+
*/
25+
final class DkimSigner
26+
{
27+
public const CANON_SIMPLE = 'simple';
28+
public const CANON_RELAXED = 'relaxed';
29+
30+
public const ALGO_SHA256 = 'rsa-sha256';
31+
public const ALGO_ED25519 = 'ed25519-sha256'; // RFC 8463
32+
33+
private $key;
34+
private $domainName;
35+
private $selector;
36+
private $defaultOptions;
37+
38+
/**
39+
* @param string $pk The private key as a string or the path to the file containing the private key, should be prefixed with file:// (in PEM format)
40+
* @param string $passphrase A passphrase of the private key (if any)
41+
*/
42+
public function __construct(string $pk, string $domainName, string $selector, array $defaultOptions = [], string $passphrase = '')
43+
{
44+
if (!\extension_loaded('openssl')) {
45+
throw new \LogicException('PHP extension "openssl" is required to use DKIM.');
46+
}
47+
if (!$this->key = openssl_pkey_get_private($pk, $passphrase)) {
48+
throw new InvalidArgumentException('Unable to load DKIM private key: '.openssl_error_string());
49+
}
50+
51+
$this->domainName = $domainName;
52+
$this->selector = $selector;
53+
$this->defaultOptions = $defaultOptions + [
54+
'algorithm' => self::ALGO_SHA256,
55+
'signature_expiration_delay' => 0,
56+
'body_max_length' => PHP_INT_MAX,
57+
'body_show_length' => false,
58+
'header_canon' => self::CANON_RELAXED,
59+
'body_canon' => self::CANON_RELAXED,
60+
'headers_to_ignore' => [],
61+
];
62+
}
63+
64+
public function sign(Message $message, array $options = []): Message
65+
{
66+
$options += $this->defaultOptions;
67+
if (!\in_array($options['algorithm'], [self::ALGO_SHA256, self::ALGO_ED25519], true)) {
68+
throw new InvalidArgumentException('Invalid DKIM signing algorithm "%s".', $options['algorithm']);
69+
}
70+
$headersToIgnore['return-path'] = true;
71+
foreach ($options['headers_to_ignore'] as $name) {
72+
$headersToIgnore[strtolower($name)] = true;
73+
}
74+
unset($headersToIgnore['from']);
75+
$signedHeaderNames = [];
76+
$headerCanonData = '';
77+
$headers = $message->getPreparedHeaders();
78+
foreach ($headers->getNames() as $name) {
79+
foreach ($headers->all($name) as $header) {
80+
if (isset($headersToIgnore[strtolower($header->getName())])) {
81+
continue;
82+
}
83+
84+
if ('' !== $header->getBodyAsString()) {
85+
$headerCanonData .= $this->canonicalizeHeader($header->toString(), $options['header_canon']);
86+
$signedHeaderNames[] = $header->getName();
87+
}
88+
}
89+
}
90+
91+
[$bodyHash, $bodyLength] = $this->hashBody($message->getBody(), $options['body_canon'], $options['body_max_length']);
92+
93+
$params = [
94+
'v' => '1',
95+
'q' => 'dns/txt',
96+
'a' => $options['algorithm'],
97+
'bh' => base64_encode($bodyHash),
98+
'd' => $this->domainName,
99+
'h' => implode(': ', $signedHeaderNames),
100+
'i' => '@'.$this->domainName,
101+
's' => $this->selector,
102+
't' => time(),
103+
'c' => $options['header_canon'].'/'.$options['body_canon'],
104+
];
105+
106+
if ($options['body_show_length']) {
107+
$params['l'] = $bodyLength;
108+
}
109+
if ($options['signature_expiration_delay']) {
110+
$params['x'] = $params['t'] + $options['signature_expiration_delay'];
111+
}
112+
$value = '';
113+
foreach ($params as $k => $v) {
114+
$value .= $k.'='.$v.'; ';
115+
}
116+
$value = trim($value);
117+
$header = new UnstructuredHeader('DKIM-Signature', $value);
118+
$headerCanonData .= rtrim($this->canonicalizeHeader($header->toString()."\r\n b=", $options['header_canon']));
119+
if (self::ALGO_SHA256 === $options['algorithm']) {
120+
if (!openssl_sign($headerCanonData, $signature, $this->key, OPENSSL_ALGO_SHA256)) {
121+
throw new RuntimeException('Unable to sign DKIM hash: '.openssl_error_string());
122+
}
123+
} else {
124+
throw new \RuntimeException(sprintf('The "%s" DKIM signing algorithm is not supported yet.', self::ALGO_ED25519));
125+
}
126+
$header->setValue($value.' b='.trim(chunk_split(base64_encode($signature), 73, ' ')));
127+
$headers->add($header);
128+
129+
return new Message($headers, $message->getBody());
130+
}
131+
132+
private function canonicalizeHeader(string $header, string $headerCanon): string
133+
{
134+
if (self::CANON_RELAXED !== $headerCanon) {
135+
return $header."\r\n";
136+
}
137+
138+
$exploded = explode(':', $header, 2);
139+
$name = strtolower(trim($exploded[0]));
140+
$value = str_replace("\r\n", '', $exploded[1]);
141+
$value = trim(preg_replace("/[ \t][ \t]+/", ' ', $value));
142+
143+
return $name.':'.$value."\r\n";
144+
}
145+
146+
private function hashBody(AbstractPart $body, string $bodyCanon, int $maxLength): array
147+
{
148+
$hash = hash_init('sha256');
149+
$relaxed = self::CANON_RELAXED === $bodyCanon;
150+
$currentLine = '';
151+
$emptyCounter = 0;
152+
$isSpaceSequence = false;
153+
$length = 0;
154+
foreach ($body->bodyToIterable() as $chunk) {
155+
$canon = '';
156+
for ($i = 0, $len = \strlen($chunk); $i < $len; ++$i) {
157+
switch ($chunk[$i]) {
158+
case "\r":
159+
break;
160+
case "\n":
161+
// previous char is always \r
162+
if ($relaxed) {
163+
$isSpaceSequence = false;
164+
}
165+
if ('' === $currentLine) {
166+
++$emptyCounter;
167+
} else {
168+
$currentLine = '';
169+
$canon .= "\r\n";
170+
}
171+
break;
172+
case ' ':
173+
case "\t":
174+
if ($relaxed) {
175+
$isSpaceSequence = true;
176+
break;
177+
}
178+
// no break
179+
default:
180+
if ($emptyCounter > 0) {
181+
$canon .= str_repeat("\r\n", $emptyCounter);
182+
$emptyCounter = 0;
183+
}
184+
if ($isSpaceSequence) {
185+
$currentLine .= ' ';
186+
$canon .= ' ';
187+
$isSpaceSequence = false;
188+
}
189+
$currentLine .= $chunk[$i];
190+
$canon .= $chunk[$i];
191+
}
192+
}
193+
194+
if ($length + \strlen($canon) >= $maxLength) {
195+
$canon = substr($canon, 0, $maxLength - $length);
196+
$length += \strlen($canon);
197+
hash_update($hash, $canon);
198+
199+
break;
200+
}
201+
202+
$length += \strlen($canon);
203+
hash_update($hash, $canon);
204+
}
205+
206+
if (0 === $length) {
207+
hash_update($hash, "\r\n");
208+
$length = 2;
209+
}
210+
211+
return [hash_final($hash, true), $length];
212+
}
213+
}

‎src/Symfony/Component/Mime/Message.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,9 @@ public function getPreparedHeaders(): Headers
8080
$headers->addMailboxListHeader('From', [$headers->get('Sender')->getAddress()]);
8181
}
8282

83-
$headers->addTextHeader('MIME-Version', '1.0');
83+
if (!$headers->has('MIME-Version')) {
84+
$headers->addTextHeader('MIME-Version', '1.0');
85+
}
8486

8587
if (!$headers->has('Date')) {
8688
$headers->addDateHeader('Date', new \DateTimeImmutable());

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy