| Server IP : 62.109.13.187 / Your IP : 216.73.216.11 [ Web Server : Apache/2.4.6 (CentOS) mpm-itk/2.4.7-04 OpenSSL/1.0.2k-fips PHP/8.2.28 System : Linux robothost.ru 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 User : mosrembit ( 6064) PHP Version : 8.2.28 Disable Function : NONE Domains : 0 Domains MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /usr/share/doc/perl-Mail-DKIM-0.39/ |
Upload File : |
Common:
- don't "die" on PRINT or CLOSE, find better ways to report the error
DKIM-Signature:
- allow version tag (DONE)
- accept q=dns/txt (DONE)
- method to set/get "z" tag
DKIM Public Key Records:
- enforce t=s option (if present)
- provide method for caller to get (to check the "testing" flag)
Verifier:
- verify multiple signatures (ietf05 6.1) (DONE)
- check that From header is signed (ietf05 6.1.1)
- check public key "granularity" (DONE)
- handle no response from first DNS server listed in resolv.conf
(currently it goes to the second server after 5 seconds,
but it does this for EVERY signature, so this will badly affect
overall throughput)
- **minor bug**- when Debug_Canonicalization=1 on a message with
multiple signatures, the canonicalized output is recorded multiple times.
Probably only the first valid signature should receive the
Debug_Canonicalization option
- provide semi-standard mechanism to report results of verification
(including what, if any, of header.from and header.sender can be trusted)
- provide mechanism in the API to run the DNS lookups in parallel with
other processing (e.g. the SpamAssassin plugin would want to start the
DNS queries as early as possible, but continue processing other aspects
of the message while waiting for the DNS queries to complete).
Net::DNS::Async may be useful here.
Policy:
- make it possible to determine explicit vs implicit default policy (DONE)
- lookup BOTH draft-allman-dkim-ssp policy AND rfc4870(historical) policy
(DONE)
- this will probably be: lookup allman policy, and if not found, then try
rfc4870(historical) policy (REJECTED)
Signer:
- allow DomainKeys signatures without using a policy object
- allow adding chained signatures in one pass
(e.g. allow adding a DomainKeys signature, and a DKIM signature,
with the new DKIM signature signing the new DomainKeys signature) (REJECTED)
- allow creation of i= and x= tags (DONE)
- allow creation of l=, t=, and z= tags
- do header-wrapping to signature before signing (DONE)
- allow signer policy to change which private key is used
Testing (some of this may already be implemented):
- test public key errors:
- DNS timeout
- SERVFAIL
- syntax error in public key record
- test DNS timeout for signing policy
- test key records composed of fragmented TXT records
- test signature options:
- unspecified query type
- query type of "dns/"
- bad query type (DONE)
- bad algorithm (DONE)
- unspecified algorithm
- bad canonicalization
- unspecified canonicalization
- test presence of version tag in signature
- IMPORTANT- allow `make test' to work when DNS is not available
- test various components of verifying, so better diagnostics can be
made when the verify.t script reports a bunch of unexplained failures
- test absense of h= tag in DKIM signature
- test use of non-ASCII characters in header names and h= tag
Possible issues in base-10 draft:
- 6.1.2 - check g= tag of public key against i= tag of signature (DONE)
- 6.1.2 - check h= tag of public key against a= tag of signature (DONE)
- 3.5 - t= tag, create it when signing messages, check it when verifying
- 3.5 - x= tag, create it when signing messages
- check it when verifying (DONE)
- 5.4 - allow better control of which headers to sign
- 5.5 - recommended headers to sign and NOT to sign (DONE)
- 3.3.1 - what's an RSA exponent?
- 6.1.1 - configurable list of unacceptable signing domains,
e.g. "com" and "co.uk"
Possible issues in RFC 4871:
- 3.6.1 - g= should be case-sensitive (see 3.2 "tag values must be
processed as case sensitive unless...", and 3.6.1, "g=", which does
NOT mention case-sensitivity)
- 3.6.1 - g= tag using irregular characters
- 3.5 - i= tag, should allow quoted-printable encoding
- 3.5 - i= tag, internationalized domains?
- 3.5 - l= tag, what happens if the number is REALLY big,
or doesn't contain a number?
- 3.5 - q= tag, should skip signature if subtype is not "txt"
(I think I do this, but do other verifiers?)
- rationale- if a dns/foo type comes out, then it will be WRONG
to lookup the txt record
- 3.2 - "if a tag name does occur more than once, the entire tag-list
is invalid"