message.go

package main

import (
	"archive/tar"
	"bytes"
	"compress/gzip"
	"crypto/x509"
	"encoding/base64"
	"encoding/pem"
	"fmt"
	"net"
	"net/mail"
	"time"

	"github.com/eaigner/dkim"
	"github.com/nymsio/pgpmail"
)

const ctHeader = "Content-Type"

type verifyData struct {
	sender  *mail.Address       // sender email address
	rawMail []byte              // raw content of recieved email
	mxlist  []*net.MX           // MX records returned for sender domain
	dkimkey string              // result of _domainkeys lookup for DKIM key
	certs   []*x509.Certificate // Certificate chain presented by SMTP server
}

func createResponse(config *Config, data *verifyData) (string, error) {
	m := new(pgpmail.Message)
	m.AddHeader("From", config.VerifyEmail)
	m.AddHeader("To", data.sender.String())
	m.AddHeader("Subject", "Nyms Mail Verification")
	m.AddHeader("X-Nyms-Verifier", "response")
	m.AddMultipart(createBody())
	attach, err := createAttachment(data)
	if err != nil {
		return "", err
	}
	m.AddMultipart(attach)
	m.PackMultiparts()
	status := m.Sign(config.KeySource, "")
	if status.Code != pgpmail.StatusSignedOnly {
		return "", fmt.Errorf("signing message failed with status code %d: %s", status.Code, status.FailureMessage)
	}
	response := m.String()
	signed, err := dkimSign(config, response)
	if err != nil {
		logger.Warning("dkim signing failed: %v", err)
		return response, nil
	}
	return signed, nil
}

func createBody() *pgpmail.MessagePart {
	p := new(pgpmail.MessagePart)
	p.AddHeader(ctHeader, "text/plain")
	p.Body = "This is an automated response generated by the Nyms mail verification system.\n"
	return p
}

func createAttachment(data *verifyData) (*pgpmail.MessagePart, error) {
	p := new(pgpmail.MessagePart)
	p.AddHeader(ctHeader, "application/octet-stream; name=\"verify_data.tgz\"")
	p.AddHeader("Content-Disposition", "attachment; filename=\"verify_data.tgz\"")
	p.AddHeader("Content-Transfer-Encoding", "base64")
	body, err := createAttachmentBody(data)
	if err != nil {
		return nil, err
	}
	p.Body = body
	return p, nil
}

func createAttachmentBody(data *verifyData) (string, error) {
	bb := new(bytes.Buffer)
	b64 := base64.NewEncoder(base64.StdEncoding, bb)
	gz := gzip.NewWriter(b64)
	tw := tar.NewWriter(gz)
	if err := writeTarContent(tw, data); err != nil {
		return "", err
	}
	if err := tw.Close(); err != nil {
		return "", err
	}
	if err := gz.Close(); err != nil {
		return "", err
	}
	if err := b64.Close(); err != nil {
		return "", err
	}
	return bb.String(), nil
}

func writeTarContent(w *tar.Writer, data *verifyData) error {
	if err := writeTarEntry(w, "message", data.rawMail); err != nil {
		return err
	}

	mxd := createMXData(data.mxlist)
	if err := writeTarEntry(w, "mx", mxd); err != nil {
		return err
	}

	if err := writeTarEntry(w, "dkim", []byte(data.dkimkey)); err != nil {
		return err
	}

	pem := createPEMData(data.certs)
	if err := writeTarEntry(w, "certs", pem); err != nil {
		return err
	}

	ts := createTimestampData()
	if err := writeTarEntry(w, "timestamp", ts); err != nil {
		return err
	}
	return nil
}

func writeTarEntry(tw *tar.Writer, name string, data []byte) error {
	h := new(tar.Header)
	h.Name = name
	h.Uid = 1000
	h.Gid = 1000
	h.Mode = 0755
	h.Size = int64(len(data))
	if err := tw.WriteHeader(h); err != nil {
		return err
	}
	if _, err := tw.Write(data); err != nil {
		return err
	}
	return nil
}

func createMXData(mxs []*net.MX) []byte {
	bb := new(bytes.Buffer)
	for _, mx := range mxs {
		fmt.Fprintf(bb, "%s %d\n", mx.Host, mx.Pref)
	}
	return bb.Bytes()
}

func createPEMData(certs []*x509.Certificate) []byte {
	b := new(bytes.Buffer)
	for _, cert := range certs {
		appendPEM(b, cert)
	}
	return b.Bytes()
}

func appendPEM(buf *bytes.Buffer, cert *x509.Certificate) {
	block := new(pem.Block)
	block.Type = "CERTIFICATE"
	block.Bytes = cert.Raw
	pem.Encode(buf, block)
}

func createTimestampData() []byte {
	ts := time.Now().Unix()
	return []byte(fmt.Sprint(ts))
}

func dkimSign(config *Config, message string) (string, error) {
	conf, err := dkim.NewConf(config.DKIMDomain, config.DKIMSelector)
	if err != nil {
		return "", err
	}
	dkim, err := dkim.New(conf, config.DKIMPrivatePEM)
	if err != nil {
		return "", err
	}
	signed, err := dkim.Sign([]byte(message))
	if err != nil {
		return "", err
	}
	return string(signed), nil
}