mirror of
https://github.com/the-djmaze/snappymail.git
synced 2026-09-07 16:37:02 +03:00
Added signing using S/MIME #259
This commit is contained in:
the-djmaze
parent
f83b60782a
commit
128e2f6254
10 changed files with 143 additions and 101 deletions
|
|
@ -11,6 +11,8 @@
|
|||
|
||||
namespace MailSo\Imap;
|
||||
|
||||
use MailSo\Mime\Enumerations\ContentType;
|
||||
|
||||
/**
|
||||
* @category MailSo
|
||||
* @package Imap
|
||||
|
|
@ -165,10 +167,10 @@ class BodyStructure implements \JsonSerializable
|
|||
{
|
||||
return ('multipart/signed' === $this->sContentType
|
||||
&& !empty($this->aContentTypeParams['protocol'])
|
||||
&& 'application/pkcs7-signature' === \strtolower(\trim($this->aContentTypeParams['protocol']))
|
||||
&& ContentType::isPkcs7Signature(\strtolower(\trim($this->aContentTypeParams['protocol'])))
|
||||
// The multipart/signed body MUST consist of exactly two parts.
|
||||
&& 2 === \count($this->aSubParts)
|
||||
&& 'application/pkcs7-signature' === $this->aSubParts[1]->ContentType()
|
||||
&& ContentType::isPkcs7Signature($this->aSubParts[1]->ContentType())
|
||||
) || ('application/pkcs7-mime' === $this->sContentType
|
||||
&& !empty($this->aContentTypeParams['smime-type'])
|
||||
&& 'signed-data' === \strtolower(\trim($this->aContentTypeParams['smime-type']))
|
||||
|
|
|
|||
|
|
@ -24,4 +24,10 @@ abstract class ContentType
|
|||
const PGP_SIGNATURE = 'application/pgp-signature';
|
||||
const PKCS7_SIGNATURE = 'application/pkcs7-signature';
|
||||
const PKCS7_MIME = 'application/pkcs7-mime';
|
||||
|
||||
public static function isPkcs7Signature(string $data) : bool
|
||||
{
|
||||
return 'application/pkcs7-signature' === $data
|
||||
|| 'application/x-pkcs7-signature' === $data;
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -11,6 +11,8 @@
|
|||
|
||||
namespace MailSo\Mime;
|
||||
|
||||
use MailSo\Mime\Enumerations\ContentType;
|
||||
|
||||
/**
|
||||
* @category MailSo
|
||||
* @package Mime
|
||||
|
|
@ -96,10 +98,10 @@ class Part
|
|||
{
|
||||
$header = $this->Headers->GetByName(Enumerations\Header::CONTENT_TYPE);
|
||||
return ($header
|
||||
&& \preg_match('#multipart/signed.+protocol=["\']?application/pkcs7-signature#si', $header->FullValue())
|
||||
&& \preg_match('#multipart/signed.+protocol=["\']?application/(x-)?pkcs7-signature#si', $header->FullValue())
|
||||
// The multipart/signed body MUST consist of exactly two parts.
|
||||
&& 2 === \count($this->SubParts)
|
||||
&& 'application/pkcs7-signature' === $this->SubParts[1]->ContentType()
|
||||
&& ContentType::isPkcs7Signature($this->SubParts[1]->ContentType())
|
||||
) || ($header
|
||||
&& \preg_match('#application/pkcs7-mime.+smime-type=["\']?signed-data#si', $header->FullValue())
|
||||
);
|
||||
|
|
|
|||
|
|
@ -1231,7 +1231,7 @@ trait Messages
|
|||
|
||||
$resource = $oBody->ToStream();
|
||||
\MailSo\Base\StreamFilters\LineEndings::appendTo($resource);
|
||||
$tmp = new \SnappyMail\File\Temporary;
|
||||
$tmp = new \SnappyMail\File\Temporary('mimepart');
|
||||
$tmp->writeFromStream($resource);
|
||||
|
||||
$oBody->Body = null;
|
||||
|
|
@ -1244,7 +1244,7 @@ trait Messages
|
|||
$sSignature = $SMIME->sign($tmp, $sCertificate);
|
||||
|
||||
if (!$sSignature) {
|
||||
throw new \Exception('GnuPG sign() failed');
|
||||
throw new \Exception('S/MIME sign() failed');
|
||||
}
|
||||
|
||||
$oPart = new MimePart;
|
||||
|
|
@ -1261,7 +1261,7 @@ trait Messages
|
|||
|
||||
$oSignaturePart = new MimePart;
|
||||
$oSignaturePart->Headers->AddByName(MimeEnumHeader::CONTENT_TYPE, 'application/pkcs7-signature; name="signature.p7s"');
|
||||
$oSignaturePart->Headers->AddByName(MimeEnumHeader::CONTENT_TRANSFER_ENCODING, '7Bit');
|
||||
$oSignaturePart->Headers->AddByName(MimeEnumHeader::CONTENT_TRANSFER_ENCODING, 'base64');
|
||||
$oSignaturePart->Body = $sSignature;
|
||||
$oPart->SubParts->append($oSignaturePart);
|
||||
}
|
||||
|
|
@ -1285,7 +1285,7 @@ trait Messages
|
|||
} else {
|
||||
$aCertificates = \json_decode($this->GetActionParam('encryptCertificates', ''), true);
|
||||
if ($aCertificates) {
|
||||
$tmp = new \SnappyMail\File\Temporary;
|
||||
$tmp = new \SnappyMail\File\Temporary('mimepart');
|
||||
$tmp->writeFromStream($oMessage->GetRootPart()->ToStream());
|
||||
|
||||
$oMessage->SubParts->Clear();
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ namespace SnappyMail\File;
|
|||
|
||||
class Temporary
|
||||
{
|
||||
protected static string $filename = '';
|
||||
protected string $filename = '';
|
||||
|
||||
function __construct(string $name, bool $prefix = true)
|
||||
{
|
||||
|
|
@ -15,7 +15,7 @@ class Temporary
|
|||
throw new \Exception("Failed to create directory {$tmpdir}");
|
||||
}
|
||||
if (!\is_writable($tmpdir)) {
|
||||
throw new \Exception("Failed to access directory {$tmpdir}");
|
||||
// throw new \Exception("Failed to access directory {$tmpdir}");
|
||||
}
|
||||
if ($prefix) {
|
||||
$this->filename = \tempnam($tmpdir, $name);
|
||||
|
|
@ -42,10 +42,10 @@ class Temporary
|
|||
private $fp = null;
|
||||
public function fopen()/* : resource|false*/
|
||||
{
|
||||
if (!$fp) {
|
||||
$fp = \fopen($this->filename, 'r+b');
|
||||
if (!$this->fp) {
|
||||
$this->fp = \fopen($this->filename, 'r+b');
|
||||
}
|
||||
return $fp;
|
||||
return $this->fp;
|
||||
}
|
||||
|
||||
public function writeFromStream(/*resource*/ $from)/* : int|false*/
|
||||
|
|
|
|||
|
|
@ -6,6 +6,8 @@ class Certificate
|
|||
{
|
||||
public
|
||||
$x509 = null,
|
||||
$pkey = null,
|
||||
|
||||
$digest = 'sha256',
|
||||
$cipher = \OPENSSL_CIPHER_AES_256_CBC,
|
||||
$keyBits = 4096,
|
||||
|
|
@ -32,10 +34,17 @@ class Certificate
|
|||
* A string having the format file://path/to/cert.pem; the named file must contain a PEM encoded certificate
|
||||
* A string containing the content of a certificate, PEM encoded, may start with -----BEGIN CERTIFICATE-----
|
||||
*/
|
||||
function __construct($x509cert = null)
|
||||
function __construct($x509cert = null, $privateKey = null)
|
||||
{
|
||||
if ($x509cert) {
|
||||
$this->x509 = \openssl_x509_read($x509cert);
|
||||
$x509cert = \openssl_x509_read($x509cert);
|
||||
if (!$x509cert) {
|
||||
throw new \RuntimeException('OpenSSL x509: ' . \openssl_error_string());
|
||||
}
|
||||
$this->x509 = $x509cert;
|
||||
if ($privateKey && \openssl_x509_check_private_key($this->x509, $privateKey)) {
|
||||
$this->pkey = $privateKey;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -24,6 +24,9 @@ class OpenSSL
|
|||
) : void
|
||||
{
|
||||
$this->private_key = \openssl_pkey_get_private($private_key, $passphrase);
|
||||
if (!$this->private_key) {
|
||||
throw new \RuntimeException('OpenSSL setPrivateKey: ' . \openssl_error_string());
|
||||
}
|
||||
}
|
||||
|
||||
public function decrypt(string $data, $certificate = null, $private_key = null) : ?string
|
||||
|
|
@ -67,31 +70,35 @@ class OpenSSL
|
|||
}
|
||||
}
|
||||
$output = new Temporary('smimeout-');
|
||||
if (!$input->putContents($data) || !\openssl_pkcs7_sign(
|
||||
if (!\openssl_pkcs7_sign(
|
||||
$input->filename(),
|
||||
$output->filename(),
|
||||
$certificate ?: $this->certificate, // \openssl_pkey_get_public();
|
||||
$private_key ?: $this->private_key, // \openssl_pkey_get_private($private_key, ?string $passphrase = null);
|
||||
$this->headers,
|
||||
\PKCS7_DETACHED, // | PKCS7_NOCERTS | PKCS7_NOATTR
|
||||
\PKCS7_DETACHED | \PKCS7_BINARY, // | PKCS7_NOCERTS | PKCS7_NOATTR
|
||||
$this->untrusted_certificates_filename
|
||||
)) {
|
||||
return null;
|
||||
throw new \RuntimeException('OpenSSL sign: ' . \openssl_error_string());
|
||||
}
|
||||
/*
|
||||
|
||||
$body = $output->getContents();
|
||||
// The message returned by openssl contains both headers and body, so need to split them up
|
||||
$parts = explode("\n\n", $body, 2);
|
||||
$this->MIMEHeader .= $parts[0] . static::$LE . static::$LE;
|
||||
$body = $parts[1];
|
||||
*/
|
||||
return $output->getContents();
|
||||
if (\preg_match('/\\.p7s"\R\R(.+?)------/s', $body, $match)) {
|
||||
return \trim($match[1]);
|
||||
}
|
||||
|
||||
throw new \RuntimeException('OpenSSL sign: failed to find p7s');
|
||||
}
|
||||
|
||||
public function verify(string $data, $signers_certificates_filename = null)
|
||||
{
|
||||
$input = new Temporary('smimein-');
|
||||
return $input->putContents($data) && true === \openssl_pkcs7_verify(
|
||||
if (\is_string($input)) {
|
||||
$input = new Temporary('smimein-');
|
||||
if (!$input->putContents($data)) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
return true === \openssl_pkcs7_verify(
|
||||
$input->filename(),
|
||||
$flags = 0,
|
||||
$signers_certificates_filename ?: null,
|
||||
|
|
|
|||
|
|
@ -60,15 +60,15 @@
|
|||
<span data-i18n="COMPOSE/BUTTON_MARK_AS_IMPORTANT"></span>
|
||||
</a>
|
||||
</li>
|
||||
<li data-bind="toggle: pgpSign, visible: canPgpSign">
|
||||
<li data-bind="toggle: doSign, visible: canSign">
|
||||
<a>
|
||||
<i class="fontastic" data-bind="text: pgpSign() ? '☑' : '☐'"></i>
|
||||
<i class="fontastic" data-bind="text: doSign() ? '☑' : '☐'"></i>
|
||||
<span data-icon="✍" data-i18n="OPENPGP/LABEL_SIGN"></span>
|
||||
</a>
|
||||
</li>
|
||||
<li data-bind="toggle: pgpEncrypt, visible: canPgpEncrypt">
|
||||
<li data-bind="toggle: doEncrypt, visible: canEncrypt">
|
||||
<a>
|
||||
<i class="fontastic" data-bind="text: pgpEncrypt() || 'mailvelope' == viewArea() ? '☑' : '☐'"></i>
|
||||
<i class="fontastic" data-bind="text: doEncrypt() || 'mailvelope' == viewArea() ? '☑' : '☐'"></i>
|
||||
<span data-icon="🔒" data-i18n="OPENPGP/LABEL_ENCRYPT"></span>
|
||||
</a>
|
||||
</li>
|
||||
|
|
@ -137,10 +137,10 @@
|
|||
<div style="display:flex">
|
||||
<div class="btn-group" style="flex-grow:1"></div>
|
||||
<div class="btn-group">
|
||||
<a class="btn fontastic" data-bind="toggle: pgpSign, visible: canPgpSign, css: {'btn-success': pgpSign()}" data-i18n="[title]OPENPGP/LABEL_SIGN">
|
||||
<a class="btn fontastic" data-bind="toggle: doSign, visible: canSign, css: {'btn-success': doSign()}" data-i18n="[title]OPENPGP/LABEL_SIGN">
|
||||
✍
|
||||
</a>
|
||||
<a class="btn fontastic" data-bind="toggle: pgpEncrypt, visible: canPgpEncrypt, css: {'btn-success': pgpEncrypt() || 'mailvelope' == viewArea()}" data-i18n="[title]OPENPGP/LABEL_ENCRYPT">
|
||||
<a class="btn fontastic" data-bind="toggle: doEncrypt, visible: canEncrypt, css: {'btn-success': doEncrypt() || 'mailvelope' == viewArea()}" data-i18n="[title]OPENPGP/LABEL_ENCRYPT">
|
||||
🔒
|
||||
</a>
|
||||
</div>
|
||||
|
|
|
|||
|
|
@ -55,40 +55,37 @@
|
|||
<input type="radio" name="identitytabs" id="tab-identity-crypto">
|
||||
<label data-i18n="CONTACTS/TAB_CRYPTO" for="tab-identity-crypto" role="tab" aria-selected="false" aria-controls="panel3" tabindex="0"></label>
|
||||
<div class="form-horizontal tab-content" role="tabpanel" aria-hidden="false">
|
||||
<details>
|
||||
<summary><strong>PGP</strong></summary>
|
||||
<div class="control-group">
|
||||
<div data-bind="component: {
|
||||
name: 'Checkbox',
|
||||
params: {
|
||||
label: 'OPENPGP/LABEL_SIGN',
|
||||
value: pgpSign,
|
||||
name: 'pgpSign'
|
||||
}
|
||||
}"></div>
|
||||
</div>
|
||||
<div class="control-group">
|
||||
<div data-bind="component: {
|
||||
name: 'Checkbox',
|
||||
params: {
|
||||
label: 'OPENPGP/LABEL_ENCRYPT',
|
||||
value: pgpEncrypt,
|
||||
name: 'pgpEncrypt'
|
||||
}
|
||||
}"></div>
|
||||
</div>
|
||||
<div class="control-group">
|
||||
<div data-bind="component: {
|
||||
name: 'Checkbox',
|
||||
params: {
|
||||
label: 'OPENPGP/LABEL_SIGN',
|
||||
value: pgpSign,
|
||||
name: 'pgpSign'
|
||||
}
|
||||
}"></div>
|
||||
</div>
|
||||
<div class="control-group">
|
||||
<div data-bind="component: {
|
||||
name: 'Checkbox',
|
||||
params: {
|
||||
label: 'OPENPGP/LABEL_ENCRYPT',
|
||||
value: pgpEncrypt,
|
||||
name: 'pgpEncrypt'
|
||||
}
|
||||
}"></div>
|
||||
</div>
|
||||
<!--
|
||||
<div class="control-group">
|
||||
<label data-i18n="OPENPGP/LABEL_ENCRYPT"></label>
|
||||
<select name="PgpEncrypt" data-bind="value: pgpEncrypt">
|
||||
<option value="Ask" data-i18n="CONTACTS/ASK"></option>
|
||||
<option value="Never" data-i18n="CONTACTS/NEVER"></option>
|
||||
<option value="Always" data-i18n="CONTACTS/ALWAYS"></option>
|
||||
<option value="IfPossible" data-i18n="CONTACTS/ALWAYS_IF_POSSIBLE"></option>
|
||||
</select>
|
||||
</div>
|
||||
<div class="control-group">
|
||||
<label data-i18n="OPENPGP/LABEL_ENCRYPT"></label>
|
||||
<select name="PgpEncrypt" data-bind="value: pgpEncrypt">
|
||||
<option value="Ask" data-i18n="CONTACTS/ASK"></option>
|
||||
<option value="Never" data-i18n="CONTACTS/NEVER"></option>
|
||||
<option value="Always" data-i18n="CONTACTS/ALWAYS"></option>
|
||||
<option value="IfPossible" data-i18n="CONTACTS/ALWAYS_IF_POSSIBLE"></option>
|
||||
</select>
|
||||
</div>
|
||||
-->
|
||||
</details>
|
||||
<details>
|
||||
<summary><strong>S/MIME</strong></summary>
|
||||
<div class="control-group">
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue