wildduck/lib/dkim-handler.js

'use strict';

const ObjectID = require('mongodb').ObjectID;
const fingerprint = require('key-fingerprint').fingerprint;
const pki = require('node-forge').pki;
const crypto = require('crypto');
const tools = require('./tools');

class DkimHandler {
    constructor(options) {
        options = options || {};
        this.cipher = options.cipher;
        this.secret = options.secret;

        this.database = options.database;
    }

    set(options, callback) {
        const domain = tools.normalizeDomain(options.domain);
        const selector = options.selector;
        const description = options.description;

        let privateKeyPem = options.privateKey;

        let fp, publicKeyPem;
        try {
            fp = fingerprint(privateKeyPem, 'sha256', true);
            let privateKey = pki.privateKeyFromPem(privateKeyPem);
            let publicKey = pki.setRsaPublicKey(privateKey.n, privateKey.e);
            publicKeyPem = pki.publicKeyToPem(publicKey);
            if (!publicKeyPem) {
                throw new Error('Was not able to extract public key from private key');
            }

            let ciphered = crypto.publicEncrypt(publicKeyPem, Buffer.from('secretvalue'));
            let deciphered = crypto.privateDecrypt(privateKeyPem, ciphered);
            if (deciphered.toString() !== 'secretvalue') {
                throw new Error('Was not able to use key for encryption');
            }
        } catch (E) {
            let err = new Error('Invalid or incompatible private key. ' + E.message);
            err.code = 'InputValidationError';
            return callback(err);
        }

        if (this.secret) {
            try {
                let cipher = crypto.createCipher(this.cipher || 'aes192', this.secret);
                privateKeyPem = '$' + cipher.update(privateKeyPem, 'utf8', 'hex');
                privateKeyPem += cipher.final('hex');
            } catch (E) {
                let err = new Error('Failed to encrypt private key. ' + E.message);
                err.code = 'InternalConfigError';
                return callback(err);
            }
        }

        let dkimData = {
            domain,
            selector,
            privateKey: privateKeyPem,
            publicKey: publicKeyPem,
            fingerprint: fp,
            created: new Date(),
            latest: true
        };

        if (description) {
            dkimData.description = description;
        }

        this.database.collection('dkim').findOneAndReplace(
            {
                domain
            },
            dkimData,
            {
                upsert: true,
                returnOriginal: false
            },
            (err, r) => {
                if (err) {
                    err.code = 'InternalDatabaseError';
                    return callback(err);
                }

                if (!r.value) {
                    let err = new Error('Failed to insert DKIM key');
                    err.code = 'InternalDatabaseError';
                    return callback(err);
                }

                return callback(null, {
                    id: r.value._id,
                    domain: dkimData.domain,
                    selector: dkimData.selector,
                    description: dkimData.description,
                    fingerprint: dkimData.fingerprint,
                    publicKey: dkimData.publicKey,
                    dnsTxt: {
                        name: dkimData.selector + '._domainkey.' + dkimData.domain,
                        value: 'v=DKIM1;t=s;p=' + dkimData.publicKey.replace(/^-.*-$/gm, '').replace(/\s/g, '')
                    }
                });
            }
        );
    }

    get(domain, includePrivateKey, callback) {
        let query = {};
        if (ObjectID.isValid(domain)) {
            query._id = domain;
        } else {
            query.domain = tools.normalizeDomain(domain);
        }

        this.database.collection('dkim').findOne(query, (err, dkimData) => {
            if (err) {
                err.code = 'InternalDatabaseError';
                return callback(err);
            }
            if (!dkimData) {
                let err = new Error('Invalid or unknown DKIM key');
                err.code = 'KeyNotFound';
                return callback(err);
            }

            let privateKey;
            if (includePrivateKey) {
                privateKey = dkimData.privateKey;
                if (privateKey.charAt(0) === '$') {
                    if (this.secret) {
                        try {
                            let decipher = crypto.createDecipher(this.cipher || 'aes192', this.secret);
                            privateKey = decipher.update(privateKey.substr(1), 'hex', 'utf-8');
                            privateKey += decipher.final('utf8');
                        } catch (E) {
                            let err = new Error('Failed to decrypt private key. ' + E.message);
                            err.code = 'InternalConfigError';
                            return callback(err);
                        }
                    } else {
                        let err = new Error('Can not use decrypted key');
                        err.code = 'InternalConfigError';
                        return callback(err);
                    }
                }
            }

            callback(null, {
                id: dkimData._id,
                domain: dkimData.domain,
                selector: dkimData.selector,
                description: dkimData.description,
                fingerprint: dkimData.fingerprint,
                publicKey: dkimData.publicKey,
                privateKey,
                dnsTxt: {
                    name: dkimData.selector + '._domainkey.' + dkimData.domain,
                    value: 'v=DKIM1;t=s;p=' + dkimData.publicKey.replace(/^-.*-$/gm, '').replace(/\s/g, '')
                },
                created: dkimData.created
            });
        });
    }

    del(domain, callback) {
        let query = {};
        if (ObjectID.isValid(domain)) {
            query._id = domain;
        } else {
            query.domain = tools.normalizeDomain(domain);
        }

        // delete address from email address registry
        this.database.collection('dkim').deleteOne(query, (err, r) => {
            if (err) {
                err.code = 'InternalDatabaseError';
                return callback(err);
            }

            if (!r.deletedCount) {
                let err = new Error('Invalid or unknown DKIM key');
                err.code = 'KeyNotFound';
                return callback(err);
            }

            return callback(null, !!r.deletedCount);
        });
    }
}

module.exports = DkimHandler;