1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
/*
* SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <hello@stalw.art>
*
* SPDX-License-Identifier: Apache-2.0 OR MIT
*/
use super::{ArcSealer, Seal, Signature};
use crate::{
crypto::{Sha256, SigningKey},
dkim::Canonicalization,
signer::{NeedDomain, NeedHeaders, NeedSelector, Ready},
};
use std::time::Duration;
impl<T: SigningKey<Hasher = Sha256>> ArcSealer<T> {
/// Creates a sealer from a SHA-256 signing key. The `a=` algorithm of
/// both headers is taken from the key.
pub fn from_key(key: T) -> ArcSealer<T, NeedDomain> {
ArcSealer {
_state: Default::default(),
signature: Signature {
a: key.algorithm(),
..Default::default()
},
seal: Seal {
a: key.algorithm(),
..Default::default()
},
key,
}
}
}
impl<T: SigningKey<Hasher = Sha256>> ArcSealer<T, NeedDomain> {
/// Sets the signing domain (`d=` of both the `ARC-Seal` and the
/// `ARC-Message-Signature`).
pub fn domain(mut self, domain: impl Into<String>) -> ArcSealer<T, NeedSelector> {
let domain = domain.into();
self.seal.d = domain.clone();
self.signature.d = domain;
ArcSealer {
_state: Default::default(),
key: self.key,
signature: self.signature,
seal: self.seal,
}
}
}
impl<T: SigningKey<Hasher = Sha256>> ArcSealer<T, NeedSelector> {
/// Sets the selector (`s=` of both headers); verifiers fetch the key from
/// `<selector>._domainkey.<domain>`.
pub fn selector(mut self, selector: impl Into<String>) -> ArcSealer<T, NeedHeaders> {
let selector = selector.into();
self.seal.s = selector.clone();
self.signature.s = selector;
ArcSealer {
_state: Default::default(),
key: self.key,
signature: self.signature,
seal: self.seal,
}
}
}
impl<T: SigningKey<Hasher = Sha256>> ArcSealer<T, NeedHeaders> {
/// Sets the names of the header fields covered by the
/// `ARC-Message-Signature` (`h=`). Names are matched case-insensitively;
/// names absent from the message are still listed, which prevents them
/// from being added later.
pub fn headers(
mut self,
headers: impl IntoIterator<Item = impl Into<String>>,
) -> ArcSealer<T, Ready> {
self.signature.h = headers.into_iter().map(|h| h.into()).collect();
ArcSealer {
_state: Default::default(),
key: self.key,
signature: self.signature,
seal: self.seal,
}
}
}
impl<T: SigningKey<Hasher = Sha256>> ArcSealer<T, Ready> {
/// Sets the `ARC-Message-Signature` validity period, counted from the
/// sealing time (`x=`), rounded up to whole seconds and capped at
/// `u64::MAX`. A zero duration, the default, omits the `x=` tag.
pub fn expiration(mut self, expiration: Duration) -> Self {
self.signature.x = expiration
.as_secs()
.saturating_add(u64::from(expiration.subsec_nanos() > 0));
self
}
/// Includes the body length (`l=`) in the `ARC-Message-Signature` when
/// `true`. Off by default; not recommended, since content can be appended
/// after the signed length.
pub fn body_length(mut self, body_length: bool) -> Self {
self.signature.l = u64::from(body_length);
self
}
/// Sets the header canonicalization of the `ARC-Message-Signature`
/// (default `relaxed`). The `ARC-Seal` always uses `relaxed`.
pub fn header_canonicalization(mut self, ch: Canonicalization) -> Self {
self.signature.ch = ch;
self
}
/// Sets the body canonicalization of the `ARC-Message-Signature`
/// (default `relaxed`).
pub fn body_canonicalization(mut self, cb: Canonicalization) -> Self {
self.signature.cb = cb;
self
}
}