DMARC XSLT :: Goofy

The task is to get the XML file from the attachment, transform it to HTML, and then re-attach the original message. The extractor sets up two temporary files and two pipelines, invoking reformime, xsltproc, makemime, and a custom C program which execs funzip or zcat. Goofy, uh?

#! /usr/bin/perl
# use: xfilter dmarc_report.pl
# transform xml using temporary file

use strict;
use warnings;
use IO::Handle;
use File::Temp qw/ tempfile /;
use Fcntl qw/ SEEK_SET SEEK_END F_SETFD /;
use Data::Dumper;

# $File::Temp::KEEP_ALL = 1;

my $failed = 0;
my $fh = tempfile() or die "cannot tempfile: $!";
my $fb = tempfile() or warn("cannot tempfile: $!"), $failed = 1;
fcntl($fb, F_SETFD, 0) or warn("Can't clear close-on-exec flag on fb: $!\n"), $failed = 1;

$SIG{PIPE} = 'IGNORE';
# reformime_funzip execs funzip or zcat if the content is a zip, or does nothing
open(XH, "|reformime -X /usr/local/bin/reformime_funzip |xsltproc dmarc_report.xsl - 1>&". fileno($fb))
 or warn("can't fork: $!"), $failed = 2;

while (<STDIN>)
{
	if ($failed == 0)
	{
		if (not print XH $_)
		{
			warn("cannot transform message: $!");
			$failed = 3;
		}
	}
	print $fh $_;
}

close XH or warn("error closing XH pipe, status: $?"), $failed = 4;
if ($failed == 0)
{
	open(MM, '|makemime @-') or warn("can't fork: $!"), $failed = 5;
}

# Print the original header, except MIME stuff

if ($failed == 0 and seek($fh, 0, SEEK_SET) and seek($fb, 0, SEEK_SET))
{
	my @mime = 
	(
		'Mime-Version',
		'Content-Type',
		'Content-Transfer-Encoding',
		'Content-Description',
		'Content-Disposition'
	);
	my $mimewords = join('|', @mime);
	my $mimeregex = qr/^($mimewords)\s*:/si;
	my $mimestuff = '';
	my $header = '';

while (<$fh>)
	{
		last if $_ eq "\n";
		if ($_ =~ /^\s+/s) { $header .= $_; next; }

my $next_header = $_;

# process $header
		if ($header =~ /$mimeregex/)
		{
			$mimestuff .= $header;
		}
		else
		{
			print $header;
		}
		$header = $next_header;
	}

STDOUT->flush();
	print MM "-j
		(
			-m
				multipart/mixed
			-a\n
				MIME-Version: 1.0
			(
				-c
					text/html; charset=utf-8
				". '&'. fileno($fb) ."
			)
		)
		".'&0'."\n-\n" or warn("bad MM pipe: $!"), $failed = 6;

if ($failed == 0)
	{
		print MM $mimestuff;
		print MM "\n";

while (<$fh>)
		{
			print MM $_;
		}
	}
	close MM or warn "error closing MM pipe: $!";
}

if ($failed != 0 and seek($fh, 0, SEEK_SET))
{
	while (<$fh>)
	{
		print $_;
	}
}

close $fh or warn "error closing header: $!";
close $fb or warn "error closing body: $!";

The author of this script has dedicated it to the public domain by waiving all of his rights to the work worldwide under copyright law, including all related and neighboring rights, to the extent allowed by law. You can copy, modify, distribute and perform this script, even for commercial purposes, all without asking permission.

The compression was initially done using zip. Later on, when application/gzip was standardized, DMARC specified gzip instead. Now, if you're good at Perl, you could fix the above Perl script. Otherwise, copy, paste, and compile the following C file:

Update: Since version 3.0 funzip supports gzip as well. The code below is useless.

/*
* reformime_funzip.c - written by vesely in milan on 18 may 2012
*
* run funzip only if it is a zip (for DMARC reports)
* gcc -W -O -DNDEBUG -o /usr/local/bin/reformime_funzip reformime_funzip.c
* gcc -W -Wall -Wno-parentheses -O0 -g -o reformime_funzip reformime_funzip.c
*/

#define FUNZIP "/usr/bin/funzip"
#define ZCAT "/bin/zcat"

static char const usage[] =
"usage:\n"
"\treformime_funzip [-h|--help]\n"
"\n"
"The help option prints this note and exits.  The same if stdin is a tty\n"
"\n"
"Otherwise the program just consumes stdin and exits, unless it is a zip:\n"
"in that cases it forks " FUNZIP " instead.\n";

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <unistd.h>
#include <signal.h>
#include <syslog.h>
#include <ctype.h>
#include <errno.h>
#include <assert.h>

int main(int argc, char *argv[])
{
	char *ct = getenv("CONTENT_TYPE");
	char *fn = getenv("FILENAME");

if ((argc > 1 &&
			(strcmp(argv[1], "-h") == 0 ||
			strcmp(argv[1], "--help") == 0)) ||
		isatty(fileno(stdin)))
	{
		puts(usage);
		return 0;
	}

if (ct)
	{
		static const char apz[] = "application";
		if (strncasecmp(ct, apz, sizeof apz -1) == 0)
		{
			char *const ct_sub = ct + sizeof apz -1;
			size_t len = fn ? strlen(fn): 0;
			if (len >= 4 && strcasecmp(fn + len - 4, ".zip") == 0 ||
				strcasecmp(ct_sub, "/zip") == 0 ||
				(strncasecmp(ct_sub, "/x-zip", 6) == 0 &&
					!isalnum((unsigned char)ct_sub[6])))
			{
				argv[0] = FUNZIP;
				execv(FUNZIP, argv);
				return 1;
			}
			else if (len >= 3 && strcasecmp(fn + len - 3, ".gz") == 0 ||
				strcasecmp(ct_sub, "/gzip") == 0)
			{
				argv[0] = ZCAT;
				execv(ZCAT, argv);
				return 1;
			}
		}
		
		while (EOF != getchar())
			continue;
	}
	
	return 0;
}

DMARC XSLT
Transform DMARC reports into HTML
[Back to stylesheet]

A tentative Perl extractor

Zip of gzip?

Update: Since version 3.0 funzip supports gzip as well. The code below is useless.

DMARC XSLT Transform DMARC reports into HTML [Back to stylesheet]

A tentative Perl extractor

Zip of gzip?

Update: Since version 3.0 funzip supports gzip as well. The code below is useless.

DMARC XSLT
Transform DMARC reports into HTML
[Back to stylesheet]