Brad Arant
cd5e0a9905
IMAP (RFC 3501): LOGIN through UID, previously all stubs except CAPABILITY/LOGOUT/a partial APPEND. Multi-folder support with per-folder UID/flag indexing (new MailFolder class, backed by .uidvalidity/.uidnext/ .imapindex sidecar files), ENVELOPE support (new MessageHeaders class: header parsing, address-list parsing, IMAP quoting), and shared cursor-based argument parsing (new IMAPArgs class: sequence sets, flag lists, dates, folder-name normalization, and path-traversal protection via isValidFolderName - a bare ".." folder name would otherwise resolve into a sibling user's mailbox directory). POP3 (RFC 1939): USER through QUIT, previously only CAPA. Added UIDL. POP3 handlers use cursor-based parsing throughout rather than indexed access - ZString's copy constructor doesn't copy its `list` field, and POP3's dispatch passes the request by value, so indexed access into a copy was silently reading nothing. SMTP: DMARC evaluation added to the DATA-terminator path (DKIM verification + alignment/policy, Authentication-Results header, conditional rejection matching RFC 7489 6.3's p=reject + sampled pct=). AUTH LOGIN now handles RFC 4954's optional inline initial response (e.g. Python smtplib's "AUTH LOGIN <base64>" in one line) instead of only the exact three-line form. Outbound relay now forces IPv4 (AF_INET) instead of AF_UNSPEC - this server's IPv4 has a correct PTR record and SPF coverage, its IPv6 doesn't, and Gmail was rejecting outbound mail with 550 5.7.25 as a result. Delivery pipeline: local delivery now runs the message through SpamAssassin (new SpamAssassinFilter class, speaking spamd's PROCESS protocol directly over a raw socket - fails open/delivers unscanned if spamd is unreachable) instead of a plain hardlink, since scanning can tag/modify content. BARANTMailConfig: extracted config loading into its own class. compile: (see individual file changes - build script adjustments to match the above). Deliberately excluded from this commit: barantmail.log/ barantmail-service.log (operational logs, not source - barantmail.log in particular was the runaway 55GB/12.9GB file from a busy-loop bug fixed separately in ServerCore) and barantmail.cfg (this server's own live deployment config, matching how APIServer's equivalent config also stays untracked).
65 lines
2.0 KiB
C++
65 lines
2.0 KiB
C++
#ifndef __DKIMSigner_h__
|
|
#define __DKIMSigner_h__
|
|
|
|
#include <openssl/evp.h>
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
namespace mail {
|
|
|
|
///
|
|
/// DKIMSigner produces a DKIM-Signature header (RFC 6376) for an
|
|
/// outbound message, using the relaxed/relaxed canonicalization and
|
|
/// rsa-sha256, the combination essentially every real deployment
|
|
/// uses (relaxed tolerates the whitespace/line-ending massaging a
|
|
/// message can pick up in transit; simple does not, and breaks
|
|
/// easily as a result).
|
|
///
|
|
/// One DKIMSigner is built for one (domain, selector, private key)
|
|
/// triple and can sign any number of messages with it - construction
|
|
/// loads and parses the private key once; sign() itself does no I/O.
|
|
///
|
|
|
|
class DKIMSigner {
|
|
|
|
public:
|
|
DKIMSigner(std::string domain, std::string selector, std::string privateKeyPath);
|
|
~DKIMSigner();
|
|
|
|
///
|
|
/// message is the complete outbound message exactly as it will be
|
|
/// sent in the DATA phase - CRLF-terminated header lines, a blank
|
|
/// line, then the body. Returns a complete "DKIM-Signature:
|
|
/// ...\r\n" line, ready to prepend to `message` as its new first
|
|
/// header.
|
|
///
|
|
|
|
std::string sign(const std::string &message);
|
|
|
|
private:
|
|
struct HeaderField {
|
|
std::string name; // original case, as it appeared
|
|
std::string value; // unfolded (continuation lines joined), not yet whitespace-collapsed
|
|
};
|
|
|
|
std::vector<HeaderField> parseHeaders(const std::string &message);
|
|
std::string bodyOf(const std::string &message);
|
|
|
|
std::string collapseWSP(const std::string &s);
|
|
std::string canonicalizeHeaderField(const std::string &name, const std::string &value);
|
|
std::string canonicalizeBody(const std::string &body);
|
|
|
|
std::string base64(const std::string &raw);
|
|
std::string sha256Base64(const std::string &data);
|
|
std::string rsaSha256SignBase64(const std::string &data);
|
|
|
|
std::string domain;
|
|
std::string selector;
|
|
EVP_PKEY *privateKey;
|
|
|
|
};
|
|
|
|
}
|
|
|
|
#endif
|