ZCS-13176 : Add mail recall message verification header #1468

shubhamCS03 · 2023-03-23T08:55:11Z

Requirement of ticket [ZCS-13176]

Requirements:

To make sure we don't recall a message accidentally or spoofed, we should add a header to outgoing email.
We need to a header field, Message-Verification , and verify the message-Id while recalling a mail.
Need to Hash data by using algorithm SHA256 and further encrypt the data by using base64.

Solution:

A new header field is added while sending mail, Message-Verification which contains hash(algorithm name) and guid(base64 of the guid's hash).
The Message-Verification header field contains the following required tags, separated by semicolons (with no white space within):
hash=[string] --the algorithm used to produce the hash value in the "guid" tag. Current valid values are "SHA1" and "SHA256" [[SHA]].
guid=[base64] --the base64 encoding [[Base64]] of the hash of a globally unique ID (GUID) for the message, using the hash algorithm specified in the "hash" tag. The actual GUID (the pre-image of the hash) is kept secret by the sending side.
We have created one LDAP attribute secretKeyForMailRecall at global level to store secretKey.
We have created one SOAP API to generate secretKey.
We have generate the secretKey using this SHA1PRNG and saved in LDAP attribute secretKeyForMailRecall .
GUID(globally unique ID) = Message-Id + Date + From + secretKey.

Testing:

Changes are tested by sending an email and by checking its show original in the header field we are able to see Message-Verification .
Also tested by decrypting the hash by using base64 we get the same value.

CLAassistant · 2023-03-23T08:55:18Z

All committers have signed the CLA.

store/src/java/com/zimbra/cs/mailbox/MailSender.java

common/src/java/com/zimbra/common/account/ZAttrProvisioning.java

store/conf/attrs/zimbra-attrs.xml

store/src/java/com/zimbra/cs/service/admin/GenerateSecretKey.java

swaatiTelus · 2023-12-28T07:40:58Z

The mail recall feature is not planned in the upcoming release so this PR should not be merged.

barrydegraaff · 2024-09-25T07:46:51Z

store/src/java/com/zimbra/cs/service/util/SecretKey.java

+     */
+    public static String generateRandomString() throws ServiceException {
+        try {
+            SecureRandom random = SecureRandom.getInstance("SHA1PRNG");


Consider using:
SecureRandom random = new SecureRandom();

https://stackoverflow.com/questions/27622625/securerandom-with-nativeprng-vs-sha1prng

ashishkataria86 · 2024-09-25T08:58:42Z

store/src/java/com/zimbra/cs/service/util/SecretKey.java

+            SecureRandom random = SecureRandom.getInstance("SHA1PRNG");
+            byte[] key = new byte[KEY_SIZE_BYTES];
+            random.nextBytes(key);
+            return new String(Hex.encodeHex(key));


Consider using Base64 for encoding to make the key more compact and URL-safe.

ashishkataria86 · 2024-09-25T09:03:35Z

store/src/java/com/zimbra/cs/service/util/SecretKey.java

+        try {
+            MessageDigest md = MessageDigest.getInstance(MSGVRFY_ALGORITHM_NAME);
+            byte[] messageDigest = md.digest(input.getBytes(StandardCharsets.UTF_8));
+            BigInteger number = new BigInteger(1, messageDigest);


You convert the BigInteger to a string and then encode it to Base64. This could be simplified:
return Base64.getEncoder().encodeToString(messageDigest);

log2akshat · 2024-10-13T17:29:56Z

store/src/java/com/zimbra/cs/service/util/SecretKey.java

+     */
+    public static String getMessageVerificationHeaderValue(String id, String date, String from) throws MessagingException, ServiceException {
+        String secretKey = Provisioning.getInstance().getConfig().getFeatureMailRecallSecretKey();
+        String guid = (id + date + from + secretKey);


Repeated use of the + operator can degrade performance as strings are immutable in Java. Each concatenation creates a new String object, leaving old strings for garbage collection, which can increase memory usage and slow down execution. Leverage Java 8 and above features.

log2akshat · 2024-10-13T17:33:24Z

store/src/java/com/zimbra/cs/service/util/SecretKey.java

+        String guidHash = getHashForMessageVerification(guid);
+        String hash = MSGVRFY_HEADER_PREFIX + guidHash;
+        return hash;
+    }


Maybe you can use Optional.ofNullable(...).orElseThrow(...) to ensure secretKey is not null and throw an exception if it is, to avoid potential null pointer and String.join(...) for concatenation.

log2akshat · 2024-10-13T17:35:10Z

store/src/java/com/zimbra/cs/mailbox/MailSender.java

-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
+import java.util.*;


Don't use implicit imports

log2akshat · 2024-10-13T17:35:19Z

store/src/java/com/zimbra/cs/mailbox/MailSender.java

-import com.zimbra.cs.account.Domain;
-import com.zimbra.cs.account.Identity;
-import com.zimbra.cs.account.Provisioning;
+import com.zimbra.cs.account.*;


Don't use implicit imports

log2akshat · 2024-10-13T17:38:36Z

store/src/java/com/zimbra/cs/mailbox/MailSender.java

+        Date date = new Date();
+        mm.setSentDate(date);
+
+        String value = SecretKey.getMessageVerificationHeaderValue(mm.getMessageID(), mailDateFormat.format(date), from.getAddress());


Make the code more expressive, and ensure it's null-safe by leveraging Java 8+ features such as Optional, method references etc.

log2akshat · 2024-10-13T17:53:23Z

store/src/java/com/zimbra/cs/account/callback/GenerateSecretKeyCallback.java

+            }
+        } catch (ServiceException e) {
+            throw ServiceException.FAILURE("Unable to initialize SecureRandom for mail recall", e);
+        }


Please optimize the code to improve the readability and efficiency of the code. Consider using Java 8 and above features such as:

Optional to wrap the value and filter it to only proceed if it equals TRUE,

method references,

try-with-resources

lambda expression to encapsulate the logic for handling the secret key and its invocation, to reduce nested conditions, improve resource management.

Also, consider catching specific exceptions.

log2akshat · 2024-10-13T17:55:46Z

store/src/java/com/zimbra/cs/service/admin/GenerateSecretKey.java

+        } catch (ServiceException e) {
+            ZimbraLog.misc.warn("Encountered exception during FlushCache after creating Secret Key", e);
+        }
+    }


Consider using Try-with-Resources

log2akshat · 2024-10-13T19:03:59Z

store/src/java/com/zimbra/cs/service/util/SecretKey.java

+            while (hexString.length() < 64) {
+                hexString.insert(0, '0');
+            }
+


You can use String.format("%064x", ...) to format the BigInteger directly into a zero-padded hexadecimal string of the desired length and remove StringBuilder.

log2akshat · 2024-10-13T19:11:55Z

common/src/java/com/zimbra/common/service/ServiceException.java

@@ -303,6 +303,10 @@ public static ServiceException LICENSE_ERROR(String message, Throwable cause) {
        return new ServiceException("license error: "+message, LICENSE_ERROR, RECEIVERS_FAULT, cause);
    }

+    public static ServiceException ERROR_MESSAGE(String str, Throwable cause){
+        return new ServiceException("error: " + str, null, SENDERS_FAULT, cause);


Avoid using + operator for String concatenation, consider using String.format or formatted if upgraded to Java 15 or above.

shubhamCS03 force-pushed the ZCS-13176 branch 3 times, most recently from d156509 to 01c1c45 Compare March 23, 2023 11:34

shubhamCS03 marked this pull request as ready for review March 23, 2023 11:50

swaatiTelus reviewed Mar 23, 2023

View reviewed changes

store/src/java/com/zimbra/cs/mailbox/MailSender.java Show resolved Hide resolved

shubhamCS03 requested review from swathy-shaji, manjeetbehera and JayaG March 23, 2023 13:11

swaatiTelus changed the title ~~Zcs 13176~~ ZCS-13176 : Add mail recall message verification header Mar 23, 2023

shubhamCS03 force-pushed the ZCS-13176 branch from c4c5ed3 to bb2b9b3 Compare March 23, 2023 13:39

shubhamCS03 requested review from dasiyogesh, gautamdg, dawoodshaikh, desouzas, k-kato, ronstra-synacor, shrutig0510, vishnukantjangid, RakeshAMore, zimsuchitgupta, barrydegraaff and swaatiTelus March 23, 2023 13:44

ronstra-synacor suggested changes Mar 23, 2023

View reviewed changes

store/src/java/com/zimbra/cs/mailbox/MailSender.java Outdated Show resolved Hide resolved

store/src/java/com/zimbra/cs/mailbox/MailSender.java Outdated Show resolved Hide resolved

shubhamCS03 force-pushed the ZCS-13176 branch from 2c24013 to 8768b5c Compare March 23, 2023 14:25

ronstra-synacor suggested changes Mar 23, 2023

View reviewed changes

shubhamCS03 requested a review from ronstra-synacor March 24, 2023 05:22

shubhamCS03 force-pushed the ZCS-13176 branch from af62894 to b577990 Compare March 24, 2023 05:29

k-kato reviewed Mar 24, 2023

View reviewed changes

store/src/java/com/zimbra/cs/mailbox/MailSender.java Outdated Show resolved Hide resolved

store/src/java/com/zimbra/cs/mailbox/MailSender.java Outdated Show resolved Hide resolved

ronstra-synacor previously approved these changes Mar 24, 2023

View reviewed changes

shubhamCS03 force-pushed the ZCS-13176 branch from c3f8c32 to 4c5f06f Compare April 13, 2023 06:19

shubhamCS03 requested a review from k-kato April 13, 2023 06:23

Prashantsurana suggested changes Apr 13, 2023

View reviewed changes

common/src/java/com/zimbra/common/account/ZAttrProvisioning.java Outdated Show resolved Hide resolved

Prashantsurana suggested changes Apr 13, 2023

View reviewed changes

store/conf/attrs/zimbra-attrs.xml Outdated Show resolved Hide resolved

shubhamCS03 force-pushed the ZCS-13176 branch from f6da08a to 887cb67 Compare April 13, 2023 09:14

shubhamCS03 requested a review from Prashantsurana April 13, 2023 09:15

k-kato reviewed Apr 13, 2023

View reviewed changes

store/src/java/com/zimbra/cs/service/admin/GenerateSecretKey.java Show resolved Hide resolved

k-kato approved these changes Apr 13, 2023

View reviewed changes

shubhamCS03 force-pushed the ZCS-13176 branch from 026f4cc to def78ba Compare April 13, 2023 10:59

shrutig0510 approved these changes Apr 13, 2023

View reviewed changes

zimsuchitgupta approved these changes Apr 13, 2023

View reviewed changes

shubhamCS03 force-pushed the ZCS-12471 branch from 06b49f0 to a14caa0 Compare May 2, 2023 07:00

shubhamCS03 mentioned this pull request May 4, 2023

ZCS-13340:Add an LDAP attribute to force users not to use username in… #1480

Merged

shubhamCS03 force-pushed the ZCS-12471 branch from a14caa0 to 29db4e7 Compare May 9, 2023 06:53

Base automatically changed from ZCS-12471 to develop May 11, 2023 06:58

shubhamCS03 force-pushed the ZCS-13176 branch 3 times, most recently from 5a58dc6 to 7c5890f Compare December 27, 2023 11:27

manjeetbehera force-pushed the ZCS-13176 branch from 1beb386 to 8ae8a13 Compare April 2, 2024 10:30

shubhamCS03 force-pushed the ZCS-13176 branch 2 times, most recently from b5427ef to 4ef5e2b Compare July 11, 2024 04:42

barrydegraaff reviewed Sep 25, 2024

View reviewed changes

ashishkataria86 reviewed Sep 25, 2024

View reviewed changes

shubhamCS03 and others added 3 commits October 1, 2024 13:38

ZCS-13176:Mail recall zimlet message verfication header

8c391b0

ZCS-13344: Support for mailRecall soap API

77f2887

ZCS-13176: change in LDAP attribute Id

683be93

shubhamCS03 force-pushed the ZCS-13176 branch from 4ef5e2b to 683be93 Compare October 1, 2024 08:09

log2akshat suggested changes Oct 13, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ZCS-13176 : Add mail recall message verification header #1468

ZCS-13176 : Add mail recall message verification header #1468

shubhamCS03 commented Mar 23, 2023 •

edited by jira bot

Loading

CLAassistant commented Mar 23, 2023 •

edited

Loading

swaatiTelus commented Dec 28, 2023

barrydegraaff Sep 25, 2024

ashishkataria86 Sep 25, 2024

ashishkataria86 Sep 25, 2024

log2akshat Oct 13, 2024

log2akshat Oct 13, 2024

log2akshat Oct 13, 2024

log2akshat Oct 13, 2024

log2akshat Oct 13, 2024

log2akshat Oct 13, 2024

log2akshat Oct 13, 2024

log2akshat Oct 13, 2024

log2akshat Oct 13, 2024

ZCS-13176 : Add mail recall message verification header #1468

Are you sure you want to change the base?

ZCS-13176 : Add mail recall message verification header #1468

Conversation

shubhamCS03 commented Mar 23, 2023 • edited by jira bot Loading

CLAassistant commented Mar 23, 2023 • edited Loading

swaatiTelus commented Dec 28, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shubhamCS03 commented Mar 23, 2023 •

edited by jira bot

Loading

CLAassistant commented Mar 23, 2023 •

edited

Loading