Skip to content

Commit 52c9112

Browse files
fabpotfabpot
committed
[Mime] Add DKIM support
1 parent 4d477ec commit 52c9112

File tree

5 files changed

+484
-1
lines changed

5 files changed

+484
-1
lines changed

‎src/Symfony/Component/Mime/CHANGELOG.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
CHANGELOG
22
=========
33

4+
5.2.0
5+
-----
6+
7+
* Add support for DKIM
8+
49
4.4.0
510
-----
611

‎src/Symfony/Component/Mime/Crypto/DkimOptions.php

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Mime\Crypto;
13+
14+
/**
15+
* A helper providing autocompletion for available DkimSigner options.
16+
*
17+
* @author Fabien Potencier <fabien@symfony.com>
18+
*/
19+
class DkimOptions
20+
{
21+
private $options = [];
22+
23+
public function toArray(): array
24+
{
25+
return $this->options;
26+
}
27+
28+
/**
29+
* @return $this
30+
*/
31+
public function algorithm(int $algo)
32+
{
33+
$this->options['algorithm'] = $algo;
34+
35+
return $this;
36+
}
37+
38+
/**
39+
* @return $this
40+
*/
41+
public function signatureExpirationDelay(int $show)
42+
{
43+
$this->options['signature_expiration_delay'] = $show;
44+
45+
return $this;
46+
}
47+
48+
/**
49+
* @return $this
50+
*/
51+
public function bodyMaxLength(int $max)
52+
{
53+
$this->options['body_max_length'] = $max;
54+
55+
return $this;
56+
}
57+
58+
/**
59+
* @return $this
60+
*/
61+
public function bodyShowLength(bool $show)
62+
{
63+
$this->options['body_show_length'] = $show;
64+
65+
return $this;
66+
}
67+
68+
/**
69+
* @return $this
70+
*/
71+
public function headerCanon(string $canon)
72+
{
73+
$this->options['header_canon'] = $canon;
74+
75+
return $this;
76+
}
77+
78+
/**
79+
* @return $this
80+
*/
81+
public function bodyCanon(string $canon)
82+
{
83+
$this->options['body_canon'] = $canon;
84+
85+
return $this;
86+
}
87+
88+
/**
89+
* @return $this
90+
*/
91+
public function headersToIgnore(array $headers)
92+
{
93+
$this->options['headers_to_ignore'] = $headers;
94+
95+
return $this;
96+
}
97+
}

‎src/Symfony/Component/Mime/Crypto/DkimSigner.php

Lines changed: 215 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,215 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Mime\Crypto;
13+
14+
use Symfony\Component\Mime\Exception\InvalidArgumentException;
15+
use Symfony\Component\Mime\Exception\RuntimeException;
16+
use Symfony\Component\Mime\Header\UnstructuredHeader;
17+
use Symfony\Component\Mime\Message;
18+
use Symfony\Component\Mime\Part\AbstractPart;
19+
20+
/**
21+
* @author Fabien Potencier <fabien@symfony.com>
22+
*
23+
* RFC 6376 and 8301
24+
*/
25+
final class DkimSigner
26+
{
27+
public const SIMPLE_CANON = 'simple';
28+
public const RELAXED_CANON = 'relaxed';
29+
30+
public const SHA_256_ALGO = 'rsa-sha256';
31+
// RFC 8463
32+
public const ED25519_ALGO = 'ed25519-sha256';
33+
34+
private $key;
35+
private $domainName;
36+
private $selector;
37+
private $defaultOptions;
38+
39+
/**
40+
* @param string $pk The private key as a string or the path to the file containing the private key, should be prefixed with file:// (in PEM format)
41+
* @param string|null $passphrase A passphrase of the private key (if any)
42+
*/
43+
public function __construct(string $pk, string $domainName, string $selector, array $defaultOptions = [], string $passphrase = '')
44+
{
45+
if (!\extension_loaded('openssl')) {
46+
throw new \LogicException('PHP extension "openssl" is required to use DKIM.');
47+
}
48+
if (!$this->key = openssl_pkey_get_private($pk, $passphrase)) {
49+
throw new InvalidArgumentException('Unable to load DKIM private key: '.openssl_error_string());
50+
}
51+
52+
$this->domainName = $domainName;
53+
$this->selector = $selector;
54+
$this->defaultOptions = $defaultOptions;
55+
}
56+
57+
public function sign(Message $message, array $options = []): Message
58+
{
59+
$options += [
60+
'algorithm' => self::SHA_256_ALGO,
61+
'signature_expiration_delay' => 0,
62+
'body_max_length' => PHP_INT_MAX,
63+
'body_show_length' => false,
64+
'header_canon' => self::RELAXED_CANON,
65+
'body_canon' => self::RELAXED_CANON,
66+
'headers_to_ignore' => [],
67+
] + $this->defaultOptions;
68+
69+
if (!\in_array($options['algorithm'], [self::SHA_256_ALGO, self::ED25519_ALGO])) {
70+
throw new InvalidArgumentException('Invalid DKIM signing algorithm "%s".', $options['algorithm']);
71+
}
72+
$headersToIgnore['return-path'] = true;
73+
foreach ($options['headers_to_ignore'] as $name) {
74+
$headersToIgnore[strtolower($name)] = true;
75+
}
76+
unset($headersToIgnore['from']);
77+
$signedHeaderNames = [];
78+
$headerCanonData = '';
79+
$headers = $message->getPreparedHeaders();
80+
foreach ($headers->getNames() as $name) {
81+
foreach ($headers->all($name) as $header) {
82+
if (isset($headersToIgnore[strtolower($header->getName())])) {
83+
continue;
84+
}
85+
86+
if ('' !== $header->getBodyAsString()) {
87+
$headerCanonData .= $this->canonicalizeHeader($header->toString(), $options['header_canon']);
88+
$signedHeaderNames[] = $header->getName();
89+
}
90+
}
91+
}
92+
93+
[$bodyHash, $bodyLength] = $this->hashBody($message->getBody(), $options['body_canon'], $options['body_max_length']);
94+
95+
$params = [
96+
'v' => '1',
97+
'q' => 'dns/txt',
98+
'a' => $options['algorithm'],
99+
'bh' => base64_encode($bodyHash),
100+
'd' => $this->domainName,
101+
'h' => implode(': ', $signedHeaderNames),
102+
'i' => '@'.$this->domainName,
103+
's' => $this->selector,
104+
't' => time(),
105+
'c' => $options['header_canon'].'/'.$options['body_canon'],
106+
];
107+
108+
if ($options['body_show_length']) {
109+
$params['l'] = $bodyLength;
110+
}
111+
if ($options['signature_expiration_delay']) {
112+
$params['x'] = $params['t'] + $options['signature_expiration_delay'];
113+
}
114+
$value = '';
115+
foreach ($params as $k => $v) {
116+
$value .= $k.'='.$v.'; ';
117+
}
118+
$value = trim($value);
119+
$header = new UnstructuredHeader('DKIM-Signature', $value);
120+
$headerCanonData .= rtrim($this->canonicalizeHeader($header->toString()."\r\n b=", $options['header_canon']));
121+
if (self::SHA_256_ALGO === $options['algorithm']) {
122+
if (!openssl_sign($headerCanonData, $signature, $this->key, OPENSSL_ALGO_SHA256)) {
123+
throw new RuntimeException('Unable to sign DKIM hash: '.openssl_error_string());
124+
}
125+
} else {
126+
throw new \RuntimeException(sprintf('The "%s" DKIM signing algorithm is not supported yet.', self::ED25519_ALGO));
127+
}
128+
$header->setValue($value.' b='.trim(chunk_split(base64_encode($signature), 73, ' ')));
129+
$headers->add($header);
130+
131+
return new Message($headers, $message->getBody());
132+
}
133+
134+
private function canonicalizeHeader(string $header, string $headerCanon): string
135+
{
136+
if (self::RELAXED_CANON !== $headerCanon) {
137+
return $header."\r\n";
138+
}
139+
140+
$exploded = explode(':', $header, 2);
141+
$name = strtolower(trim($exploded[0]));
142+
$value = str_replace("\r\n", '', $exploded[1]);
143+
$value = trim(preg_replace("/[ \t][ \t]+/", ' ', $value));
144+
145+
return $name.':'.$value."\r\n";
146+
}
147+
148+
private function hashBody(AbstractPart $body, string $bodyCanon, int $maxLength): array
149+
{
150+
$hash = hash_init('sha256');
151+
$relaxed = self::RELAXED_CANON === $bodyCanon;
152+
$currentLine = '';
153+
$emptyCounter = 0;
154+
$isSpaceSequence = false;
155+
$length = 0;
156+
foreach ($body->bodyToIterable() as $chunk) {
157+
$canon = '';
158+
for ($i = 0, $len = \strlen($chunk); $i < $len; ++$i) {
159+
switch ($chunk[$i]) {
160+
case "\r":
161+
break;
162+
case "\n":
163+
// previous char is always \r
164+
if ($relaxed) {
165+
$isSpaceSequence = false;
166+
}
167+
if ('' === $currentLine) {
168+
++$emptyCounter;
169+
} else {
170+
$currentLine = '';
171+
$canon .= "\r\n";
172+
}
173+
break;
174+
case ' ':
175+
case "\t":
176+
if ($relaxed) {
177+
$isSpaceSequence = true;
178+
break;
179+
}
180+
// no break
181+
default:
182+
if ($emptyCounter > 0) {
183+
$canon .= str_repeat("\r\n", $emptyCounter);
184+
$emptyCounter = 0;
185+
}
186+
if ($isSpaceSequence) {
187+
$currentLine .= ' ';
188+
$canon .= ' ';
189+
$isSpaceSequence = false;
190+
}
191+
$currentLine .= $chunk[$i];
192+
$canon .= $chunk[$i];
193+
}
194+
}
195+
196+
if ($length + \strlen($canon) >= $maxLength) {
197+
$canon = substr($canon, 0, $maxLength - $length);
198+
$length += \strlen($canon);
199+
hash_update($hash, $canon);
200+
201+
break;
202+
}
203+
204+
$length += \strlen($canon);
205+
hash_update($hash, $canon);
206+
}
207+
208+
if (0 === $length) {
209+
hash_update($hash, "\r\n");
210+
$length = 2;
211+
}
212+
213+
return [hash_final($hash, true), $length];
214+
}
215+
}

‎src/Symfony/Component/Mime/Message.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,9 @@ public function getPreparedHeaders(): Headers
8080
$headers->addMailboxListHeader('From', [$headers->get('Sender')->getAddress()]);
8181
}
8282

83-
$headers->addTextHeader('MIME-Version', '1.0');
83+
if (!$headers->has('MIME-Version')) {
84+
$headers->addTextHeader('MIME-Version', '1.0');
85+
}
8486

8587
if (!$headers->has('Date')) {
8688
$headers->addDateHeader('Date', new \DateTimeImmutable());

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy