|
| 1 | +<?php |
| 2 | + |
| 3 | +/* |
| 4 | +Copyright (c) 2018, Florian Schaal - schaal @it UG |
| 5 | +All rights reserved. |
| 6 | +
|
| 7 | +Redistribution and use in source and binary forms, with or without modification, |
| 8 | +are permitted provided that the following conditions are met: |
| 9 | +
|
| 10 | + * Redistributions of source code must retain the above copyright notice, |
| 11 | + this list of conditions and the following disclaimer. |
| 12 | + * Redistributions in binary form must reproduce the above copyright notice, |
| 13 | + this list of conditions and the following disclaimer in the documentation |
| 14 | + and/or other materials provided with the distribution. |
| 15 | + * Neither the name of ISPConfig nor the names of its contributors |
| 16 | + may be used to endorse or promote products derived from this software without |
| 17 | + specific prior written permission. |
| 18 | +
|
| 19 | +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND |
| 20 | +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED |
| 21 | +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
| 22 | +IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, |
| 23 | +INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, |
| 24 | +BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| 25 | +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY |
| 26 | +OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING |
| 27 | +NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, |
| 28 | +EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 29 | +*/ |
| 30 | + |
| 31 | +require_once '../../lib/config.inc.php'; |
| 32 | +require_once '../../lib/app.inc.php'; |
| 33 | + |
| 34 | +//* Check permissions for module |
| 35 | +$app->auth->check_module_permissions('mail'); |
| 36 | + |
| 37 | +$type = $_GET['type']; |
| 38 | +$domain_id = $_GET['domain_id']; |
| 39 | + |
| 40 | +if($type == 'create_dkim' && $domain_id != ''){ |
| 41 | + $dkim_public = $_GET['dkim_public']; |
| 42 | + $dkim_selector = $_GET['dkim_selector']; |
| 43 | + $client_id = $_GET['client_group_id']; |
| 44 | + $server_id = $_GET['server_id']; |
| 45 | + |
| 46 | + $domain=@(is_numeric($domain_id))?$app->db->queryOneRecord("SELECT domain FROM domain WHERE domain_id = ?", $domain_id)['domain']:$domain_id; |
| 47 | + $maildomain = $app->db->queryOneRecord("SELECT domain FROM mail_domain WHERE domain = ?", $domain)['domain']; |
| 48 | + |
| 49 | + $mail_config = $app->getconf->get_server_config($server_id, 'mail'); |
| 50 | + $dkim_strength = $app->functions->intval($mail_config['dkim_strength']); |
| 51 | + if ($dkim_strength=='') $dkim_strength = 2048; |
| 52 | + |
| 53 | + $rnd_val = $dkim_strength * 10; |
| 54 | + exec('openssl rand -out ../../temp/random-data.bin '.$rnd_val.' 2> /dev/null', $output, $result); |
| 55 | + exec('openssl genrsa -rand ../../temp/random-data.bin '.$dkim_strength.' 2> /dev/null', $privkey, $result); |
| 56 | + unlink("../../temp/random-data.bin"); |
| 57 | + $dkim_private=''; |
| 58 | + foreach($privkey as $values) $dkim_private=$dkim_private.$values."\n"; |
| 59 | + |
| 60 | + if ($dkim_public != '' && $maildomain != '') { |
| 61 | + if (validate_domain($domain) && validate_selector($dkim_selector) ) { |
| 62 | + //* get active selectors from dns |
| 63 | + $soa_rec = $app->db->queryOneRecord("SELECT origin FROM dns_soa WHERE active = 'Y' AND origin = ?", $domain.'.'); |
| 64 | + if (isset($soa_rec) && !empty($soa_rec)) { |
| 65 | + //* check for a dkim-record in the dns? |
| 66 | + $dns_data = $app->db->queryOneRecord("SELECT name FROM dns_rr WHERE name = ? AND active = 'Y'", $dkim_selector.'._domainkey.'.$domain.'.'); |
| 67 | + if (!empty($dns_data)){ |
| 68 | + $selector = str_replace( '._domainkey.'.$domain.'.', '', $dns_data['name']); |
| 69 | + } else { |
| 70 | + } |
| 71 | + } |
| 72 | + if ($dkim_selector == $selector || !isset($selector)) { |
| 73 | + $selector = substr($old_selector,0,53).time(); //* add unix-timestamp to delimiter to allow old and new key in the dns |
| 74 | + } |
| 75 | + } else { |
| 76 | + $selector = 'invalid domain or selector'; |
| 77 | + } |
| 78 | + } else { |
| 79 | + unset($dkim_public); |
| 80 | + exec('echo '.escapeshellarg($dkim_private).'|openssl rsa -pubout -outform PEM 2> /dev/null',$pubkey,$result); |
| 81 | + foreach($pubkey as $values) $dkim_public=$dkim_public.$values."\n"; |
| 82 | + $selector = $dkim_selector; |
| 83 | + } |
| 84 | + |
| 85 | + $dns_record=str_replace(array('-----BEGIN PUBLIC KEY-----','-----END PUBLIC KEY-----',"\r","\n"),'',$dkim_public); |
| 86 | + $dns_record = str_replace(array("\r\n", "\n", "\r"),'',$dns_record); |
| 87 | + |
| 88 | + $dkim_private=json_encode($dkim_private); |
| 89 | + $dkim_private=substr($dkim_private, 1, -1); |
| 90 | + |
| 91 | + $dkim_public=json_encode($dkim_public); |
| 92 | + $dkim_public=substr($dkim_public, 1, -1); |
| 93 | + |
| 94 | + $json = '{'; |
| 95 | + $json .= '"dkim_private":"'.$dkim_private.'"'; |
| 96 | + $json .= ',"dkim_public":"'.$dkim_public.'"'; |
| 97 | + $json .= ',"dkim_selector":"'.$selector.'"'; |
| 98 | + $json .= ',"dns_record":"'.$dns_record.'"'; |
| 99 | + $json .= ',"domain":"'.$domain.'"'; |
| 100 | + $json .= '}'; |
| 101 | +} |
| 102 | +header('Content-type: application/json'); |
| 103 | +echo $json; |
| 104 | + |
| 105 | +function validate_domain($domain) { |
| 106 | + $regex = '/^[\w\.\-]{2,255}\.[a-zA-Z0-9\-]{2,30}$/'; |
| 107 | + if ( preg_match($regex, $domain) === 1 ) return true; else return false; |
| 108 | +} |
| 109 | + |
| 110 | +function validate_selector($selector) { |
| 111 | + $regex = '/^[a-z0-9]{0,63}$/'; |
| 112 | + if ( preg_match($regex, $selector) === 1 ) return true; else return false; |
| 113 | +} |
| 114 | + |
| 115 | +?> |
0 commit comments