search

abhishek-ram / django-pyas2

AS2 file transfer Server built on Python and Django.
https://django-pyas2.readthedocs.io
GNU General Public License v3.0
78 stars 31 forks source link

Parse MDN from response headers #48

Closed adiroiban closed 3 years ago

adiroiban commented 3 years ago

I have the following use case:

Sending a file from pyas2 to a partner, without any signature and encryption. MDN is requested in sync mode, without any signature.

The message is:

Content-Type: application/edi-consent
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="Screenshot_2020-07-29 Domain test running.png"
AS2-Version: 1.2
ediint-features: CMS
Message-ID: <159602463146.13.8225888991652769525@f70d978e28f8>
AS2-From: pyas2-docker
AS2-To: "SP Adi"
Subject: EDI Message sent using pyas2
Date: Wed, 29 Jul 2020 12:10:31 +0000
disposition-notification-to: no-reply@pyas2.com

The response headers are like this, without any body:

Content-Type: message/disposition-notification
Content-Transfer-Encoding: 7bit

Reporting-UA: AS2 Server
Original-Recipient: rfc822; "SP Adi"
Final-Recipient: rfc822; "SP Adi"
Original-Message-ID: <159602463146.13.8225888991652769525@f70d978e28f8>
Disposition: automatic-action/MDN-sent-automatically;processed

Since this is only a simple MDN without any signature, it does not need to be wrapped into a multi part.

But I think that pyas2 tries to extract it from the multipart body.

The error from pyas2 is Partner failed to process message: mdn-not-found

Thanks for this great project.

abhishek-ram commented 3 years ago

This is not as per AS2 standards, refer here https://tools.ietf.org/html/rfc4130#section-7.4.2 If it had at least been in the body then something could have been done but since its not you need to ask your partner to either user a proper AS2 software or disable Request MDN for this partner and PyAs2 wont try to process this.

adiroiban commented 3 years ago

Thanks for your reference.

In Sectionn 4.2 https://tools.ietf.org/html/rfc4130#section-4.2 i see this structure.

When no encryption or signature is used, the request is not wrapped in MIME... that is, no multipart. Based on the same principle, I assumed that the MDN is also not wrapped.


4.2.  Structure of an Internet EDI MIME Message

   No encryption, no signature
      -RFC2616/2045
         -RFC1767/RFC3023 (application/EDIxxxx or /xml)

   MDN over HTTP, no signature
      -RFC2616/2045
        -RFC3798 (message/disposition-notification)

Also in section 7.4.2 I see 

   When the message is
   unsigned, the transfer-layer ("outermost") entity-headers of the
   AS2-MDN contain the content-type header that specifies a content-type
   of "multipart/report" and parameters indicating the report-type, and
   the value of the outermost multipart boundary.

Here, with transfer-layer outermost, I understand the HTTP response/request headers or SMTP headers.

I now see that there is seprate librarty used by django-pyas2 to parse the MDN, I I guess that this should be closed anyway and moved there.

I have also tested JScape AS2 implementation which is advertised as "certified" and I see the same error.

adiroiban commented 3 years ago

Thanks for your time. I got it wrong.

For the reference. For unsigned MDN the sync response should look like.

HTTP/1.0 200 OK
AS2-From: 0123456780000
AS2-To: "\"  as2Name  \""
AS2-Version: 1.1
Message-ID: <709700825.1028122454671.JavaMail@ediXchange>
Content-Type: multipart/report; report-type=disposition-notification; boundary="----=_Part_336_6069110.1040310218718"

------=_Part_336_6069110.1040310218718
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

The message <x12.edi> sent to Recipient <AS2 Test> on Thu, 19 Dec
2002 15:04:18 GMT with Subject <async MDN request> has been received.
The EDI Interchange was successfully decrypted, and its integrity was
verified.  In addition, the sender of the message, Sender
<as2_company> at Location http://10.240.1.2:8201/exchange/as2_company
was authenticated as the originator of the message.  There is no
guarantee, however, that the EDI interchange was syntactically
correct, or that it was received by the EDI application/translator.

------=_Part_336_6069110.1040310218718
Content-Type: message/disposition-notification
Content-Transfer-Encoding: 7bit

Reporting-UA: AS2@test:8101
Original-Recipient: rfc822; "AS2 Test"
Final-Recipient: rfc822; "AS2 Test"
Original-Message-ID: <#as2_company#01#a4260as2_companyout#>
Disposition: automatic-action/MDN-sent-automatically; processed
Received-Content-MIC: Hes6my+vIxIYxmvsA+MNpEOTPAc=, sha1

------=_Part_336_6069110.1040310218718--